security-tools/sigma-rules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Prep main for 9.1 (#4555)

Browse Source 
* Prep for Release 9.1

* Update Patch Version

* Update Patch version

* Update Patch version
This commit is contained in:
shashank-elastic
2025-03-26 20:34:14 +05:30
committed by GitHub
parent 2d2c5b4d88
commit e8c54169a4
422 changed files with 11786 additions and 12086 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/initial_access_script_executing_powershell.toml
+9 -4
View File
@@ -2,9 +2,7 @@
creation_date = "2020/02/18"
integration = ["endpoint", "windows", "m365_defender", "sentinel_one_cloud_funnel"]
maturity = "production"
updated_date = "2024/10/15"
min_stack_version = "8.14.0"
min_stack_comments = "Breaking change at 8.14.0 for the Windows Integration."
updated_date = "2025/03/20"
[rule]
author = ["Elastic"]
@@ -13,7 +11,14 @@ Identifies a PowerShell process launched by either cscript.exe or wscript.exe. O
executing a PowerShell script, may be indicative of malicious activity.
"""
from = "now-9m"
index = ["winlogbeat-*", "logs-endpoint.events.process-*", "logs-windows.sysmon_operational-*", "endgame-*", "logs-m365_defender.event-*", "logs-sentinel_one_cloud_funnel.*"]
index = [
"winlogbeat-*",
"logs-endpoint.events.process-*",
"logs-windows.sysmon_operational-*",
"endgame-*",
"logs-m365_defender.event-*",
"logs-sentinel_one_cloud_funnel.*",
]
language = "eql"
license = "Elastic License v2"
name = "Windows Script Executing PowerShell"