#51 resolved

2020-12-16 20:29:08 +09:00
parent c7dd0adfe1
commit a77edfb311
13 changed files with 34 additions and 18 deletions
--- a/rules/deep_blue_cli/powershell/4103.yml
+++ b/rules/deep_blue_cli/powershell/4103.yml
@@ -6,7 +6,7 @@ logsource:
    product: windows
 detection:
    selection:
-        Channel: PowerShell
+        Channel: Microsoft-Windows-PowerShell/Operational
        EventID: 4103
        ContextInfo:
            - Host Application
@@ -17,4 +17,4 @@ falsepositives:
 level: medium
 output: 'command=%CommandLine%'
 creation_date: 2020/11/8
-uodated_date: 2020/11/8
+updated_date: 2020/11/8