#60

2021-03-03 23:29:27 +09:00
parent 7f99dadcb4
commit 7bd044272c
2 changed files with 72 additions and 0 deletions
--- a/rules/powershell/downgrade_attack.yml
+++ b/rules/powershell/downgrade_attack.yml
@@ -0,0 +1,17 @@
+title: PowerShell DownGradeAttack
+description: hogehoge
+enabled: true
+author: Yea
+logsource: 
+    product: windows
+detection:
+    selection:
+        Channel: Windows PowerShell
+        EventID: 400
+        EventData: '[\s\S]*EngineVersion=2.0[\s\S]*'
+falsepositives:
+    - unknown
+level: medium
+output: 'Powershell DownGrade Attack Detected!!'
+creation_date: 2020/11/8
+updated_date: 2020/11/8