removed noisy rules

2021-11-15 08:56:09 +09:00
parent 464c7ec052
commit b2eab00604
11 changed files with 0 additions and 0 deletions
--- a/rules/PowershellOperational/4104_T1059_PowershellExecutionRemoteCommand.yml
+++ b/rules/PowershellOperational/4104_T1059_PowershellExecutionRemoteCommand.yml
@@ -1,21 +0,0 @@
-title: PowerShell Execution Remote Command
-title_jp: Powershellのリモートコマンドの実行
-description: Powershell command executed remotely.
-description_jp: Powershell command executed remotely.
-author: Eric Conrad
-contributor: Zach Mathis
-mitre_attack: T1059
-level: medium
-detection:
-    selection:
-        Channel: Microsoft-Windows-PowerShell/Operational
-        EventID: 4104
-        Path: null
-        ScriptBlockText|re: '.+'
-    # condition: selection
-falsepositives:
-    - normal system usage
-output: 'Command = %ScriptBlockText%'
-output: 'コマンド = %ScriptBlockText%'
-creation_date: 2020/11/08
-updated_date:  2021/11/06