under constructing

rules/deep_blue_cli/powershell/4103.yml

@@ -0,0 +1,20 @@
+title: PowerShell Execution Pipeline
+description: hogehoge
+enabled: true
+author: Yea
+logsource: 
+    product: windows
+detection:
+    selection:
+        EventLog: PowerShell
+        EventID: 4103
+        ContextInfo:
+            - Host Application
+            - ホスト アプリケーション
+    condition: selection
+falsepositives:
+    - unknown
+level: medium
+output: 'command=%CommandLine%'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8

rules/deep_blue_cli/powershell/4104.yml

@@ -0,0 +1,19 @@
+title: PowerShell Execution Remote Command
+description: hogehoge
+enabled: true
+author: Yea
+logsource: 
+    product: windows
+detection:
+    selection:
+        EventLog: PowerShell
+        EventID: 4104
+        Path: ''
+        ScriptBlockText: '.'
+    condition: selection
+falsepositives:
+    - unknown
+level: medium
+output: 'command=%CommandLine%'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8

rules/deep_blue_cli/powershell/powershell4103.toml

@@ -1,4 +0,0 @@
-[rule]
-severity = "high"
-name = "4103"
-message = "Execute Pipeline"

rules/deep_blue_cli/powershell/powershell4104.toml

@@ -1,4 +0,0 @@
-[rule]
-severity = "high"
-name = "4104"
-message = "Excute Remote Command"