security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update powershell_cmdline_special_characters.yml

Browse Source
This commit is contained in:
Vasiliy Burov
2020-10-15 19:39:24 +03:00
committed by GitHub
parent 1b0d4e546f
commit fa7036430e
1 changed files with 6 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/powershell/powershell_cmdline_special_characters.yml
+6 -5
View File
@@ -17,11 +17,12 @@ logsource:
detection:
selection:
Image|endswith: '\powershell.exe'
CommandLine|re: '.*`.*`.*`.*`.*`.*'
CommandLine|re: '.*^.*^.*^.*^.*^.*'
CommandLine|re: '.*{.*{.*{.*{.*{.*'
CommandLine|re: '.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*'
CommandLine|re: '.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*'
CommandLine|re:
- '.*`.*`.*`.*`.*`.*'
- '.*^.*^.*^.*^.*^.*'
- '.*{.*{.*{.*{.*{.*'
- '.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*'
- '.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*'
condition: selection
falsepositives:
- Unlikely