security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

change to category: ps_script

Browse Source
This commit is contained in:
frack113
2021-10-16 08:18:49 +02:00
parent 0ca16b18f4
commit f6b0a89161
51 changed files with 107 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_script/powershell_shellcode_b64.yml
+2 -3
View File
@@ -13,14 +13,13 @@ tags:
- attack.t1086 #an old one
author: David Ledbetter (shellcode), Florian Roth (rule)
date: 2018/11/17
modified: 2020/12/01
modified: 2021/10/16
logsource:
product: windows
service: powershell
category: ps_script
definition: Script block logging must be enabled
detection:
selection:
EventID: 4104
ScriptBlockText|contains: 'AAAAYInlM'
selection2:
ScriptBlockText|contains: