regex rule implemented

2020-11-21 22:56:21 +09:00
parent 1abdbafb5a
commit d976ddc4d0
31 changed files with 675 additions and 1809 deletions
--- a/rules/deep_blue_cli/powershell/4103.yml
+++ b/rules/deep_blue_cli/powershell/4103.yml
@@ -6,12 +6,12 @@ logsource:
    product: windows
 detection:
    selection:
-        EventLog: PowerShell
+        Channel: PowerShell
        EventID: 4103
        ContextInfo:
            - Host Application
            - ホスト アプリケーション
-    condition: selection
+    # condition: selection
 falsepositives:
    - unknown
 level: medium
--- a/rules/deep_blue_cli/powershell/4104.yml
+++ b/rules/deep_blue_cli/powershell/4104.yml
@@ -6,11 +6,11 @@ logsource:
    product: windows
 detection:
    selection:
-        EventLog: PowerShell
+        Channel: PowerShell
        EventID: 4104
-        Path: ''
-        ScriptBlockText: '.'
-    condition: selection
+        Path: null
+        ScriptBlockText: null
+    # condition: selection
 falsepositives:
    - unknown
 level: medium