Update defense_evasion_posh_assembly_load.toml (#4543)
Co-authored-by: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
This commit is contained in:
@@ -4,7 +4,7 @@ integration = ["windows"]
|
||||
maturity = "production"
|
||||
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
|
||||
min_stack_version = "8.14.0"
|
||||
updated_date = "2025/02/03"
|
||||
updated_date = "2025/03/19"
|
||||
|
||||
[transform]
|
||||
[[transform.osquery]]
|
||||
@@ -133,8 +133,7 @@ event.category:process and host.os.type:windows and
|
||||
powershell.file.script_block_text : (
|
||||
"[System.Reflection.Assembly]::Load" or
|
||||
"[Reflection.Assembly]::Load" or
|
||||
"Assembly.Load(" or
|
||||
"System.Reflection"
|
||||
"Assembly.Load("
|
||||
) and
|
||||
not powershell.file.script_block_text : (
|
||||
("CommonWorkflowParameters" or "RelatedLinksHelpInfo") and
|
||||
|
||||
Reference in New Issue
Block a user