Merge branch '7.9' into main

2020-08-27 15:54:44 -08:00
parent 779a3a5b0d 4ffdc46ba7
commit aec3ec31b9
76 changed files with 225 additions and 150 deletions
@@ -10,6 +10,7 @@ description = """
 Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes
 executing a PowerShell script, may be indicative of malicious activity.
 """
+from = "now-9m"
 index = ["winlogbeat-*", "logs-endpoint.events.*"]
 language = "kuery"
 license = "Elastic License"