3 Commits

Author	SHA1	Message	Date
Jonhnathan	851c566730	[Rule Tuning] Replaces event.code with event.category on PowerShell ScriptBlock Rules (#1620) ... * Replaces event.code with event.category * bump updated_date Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2021-12-07 21:32:39 -09:00
Justin Ibarra	14c46f50b9	[Rule Tuning] updates from documentation review for 7.16 (#1645)	2021-12-07 15:42:58 -09:00
Jonhnathan	f50fb1d61b	[New Rule] Suspicious Portable Executable Encoded in Powershell Script (#1562) ... * Create execution_posh_portable_executable.toml * Add wildcard * Remove the wildcard * Update rules/windows/execution_posh_portable_executable.toml Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com> Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>	2021-10-18 17:50:16 -03:00