resolved #40

2020-12-07 12:18:48 +09:00
parent 67da36c919
commit f58d5f316b
4 changed files with 63 additions and 22 deletions
--- a/rules/deep_blue_cli/powershell/4104.yml
+++ b/rules/deep_blue_cli/powershell/4104.yml
@@ -6,14 +6,14 @@ logsource:
    product: windows
 detection:
    selection:
-        Channel: PowerShell
+        Channel: Microsoft-Windows-PowerShell/Operational
        EventID: 4104
        Path: null
-        ScriptBlockText: null
+        ScriptBlockText: '.+'
    # condition: selection
 falsepositives:
    - unknown
 level: medium
-output: 'command=%CommandLine%'
+output: 'command=%ScriptBlockText%'
 creation_date: 2020/11/8
-uodated_date: 2020/11/8
+updated_date: 2020/11/8