 Jonhnathan
|
216d39601a
|
[Rule Tuning] Add Investigation Guides, Config/Logging Policy to PowerShell merged rules (#1610)
* Add Investigation Guide and config to Suspicious Portable Executable Encoded in Powershell Script
* Add Investigation Guide and config to "PowerShell Suspicious Discovery Related Windows API Functions" rule
* Add Investigation Guide and Config to "PowerShell MiniDump Script" rule
* Add logging policy reference
* Add Investigation Guide/Config to "PowerShell Suspicious Script with Audio Capture Capabilities"
* Add Related Rules GUIDs
* Add Investigation Guide/config for "Potential Process Injection via PowerShell"
* Adjust Response and remediation
* Add Investigation Guide/config for "PowerShell Keylogging Script"
* bump updated_date
* Apply suggestions from Samir
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
* Apply suggestions
* Revise line from investigation guides
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Samirbous <64742097+Samirbous@users.noreply.github.com>
(cherry picked from commit 49854aaae2)
|
2022-01-20 11:58:49 +00:00 |
|
|
Jonhnathan
|
857ec6ba94
|
[Rule Tuning] Replaces event.code with event.category on PowerShell ScriptBlock Rules (#1620)
* Replaces event.code with event.category
* bump updated_date
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
(cherry picked from commit 851c566730)
|
2021-12-08 06:34:37 +00:00 |
|
|
Justin Ibarra
|
a8919b9070
|
[Rule Tuning] updates from documentation review for 7.16 (#1645)
(cherry picked from commit 14c46f50b9)
|
2021-12-08 00:45:10 +00:00 |
|
|
Jonhnathan
|
f50fb1d61b
|
[New Rule] Suspicious Portable Executable Encoded in Powershell Script (#1562)
* Create execution_posh_portable_executable.toml
* Add wildcard
* Remove the wildcard
* Update rules/windows/execution_posh_portable_executable.toml
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
Co-authored-by: Justin Ibarra <brokensound77@users.noreply.github.com>
|
2021-10-18 17:50:16 -03:00 |
|