Update defense_evasion_posh_assembly_load.toml (#4543)

Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
This commit is contained in:
Samirbous
2025-03-20 08:13:28 +00:00
committed by GitHub
parent 5ccb7ed4af
commit 28a06fd25f
@@ -4,7 +4,7 @@ integration = ["windows"]
maturity = "production"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
min_stack_version = "8.14.0"
updated_date = "2025/02/03"
updated_date = "2025/03/19"
[transform]
[[transform.osquery]]
@@ -133,8 +133,7 @@ event.category:process and host.os.type:windows and
powershell.file.script_block_text : (
"[System.Reflection.Assembly]::Load" or
"[Reflection.Assembly]::Load" or
"Assembly.Load(" or
"System.Reflection"
"Assembly.Load("
) and
not powershell.file.script_block_text : (
("CommonWorkflowParameters" or "RelatedLinksHelpInfo") and