Feature/#140 document (#144)

* update * fix regexes and whitelist * underconstructing * fix * update * add pic * update * update * update * fix
2021-10-22 00:43:40 +09:00
parent 23c60fa8ff
commit 4a1e46e47e
38 changed files with 502 additions and 241 deletions
--- a/rules/deep_blue_cli/powershell/4103.yml
+++ b/rules/deep_blue_cli/powershell/4103.yml
@@ -1,8 +1,6 @@
 title: PowerShell Execution Pipeline
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
    selection:
        Channel: Microsoft-Windows-PowerShell/Operational
@@ -13,7 +11,6 @@ detection:
    # condition: selection
 falsepositives:
    - unknown
-level: medium
 output: 'command=%CommandLine%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8
--- a/rules/deep_blue_cli/powershell/4104.yml
+++ b/rules/deep_blue_cli/powershell/4104.yml
@@ -1,8 +1,6 @@
 title: PowerShell Execution Remote Command
 description: hogehoge
 author: Yea
-logsource: 
-    product: windows
 detection:
    selection:
        Channel: Microsoft-Windows-PowerShell/Operational
@@ -12,7 +10,6 @@ detection:
    # condition: selection
 falsepositives:
    - unknown
-level: medium
 output: 'command=%ScriptBlockText%'
 creation_date: 2020/11/8
 updated_date: 2020/11/8