powershellの解析、Check-Commandの修正

src/detections/powershell.rs

@@ -57,11 +57,12 @@ impl PowerShell {
     ) {
         // リモートコマンドを実行します
         let default = String::from("");
-        let message_num = event_data.get("MessageNumber");
-        let commandline = event_data.get("ScriptBlockText").unwrap_or(&default);
-
-        if let Some(_) = message_num {
-            utils::check_command(4104, &commandline, 1000, 0, &default, &default, rdr);
+        let path = event_data.get("Path").unwrap().to_string();
+        if path == "".to_string() {
+            let commandline = event_data.get("ScriptBlockText").unwrap_or(&default);
+            if commandline.to_string() != default {
+                utils::check_command(4104, &commandline, 1000, 0, &default, &default, rdr);
+            }
         }
     }
 }