Remove loose wildcard filter in powershell encoded cmd rule

2024-11-07 17:58:52 +00:00 · 2019-04-11 12:53:12 +02:00 · 2019-04-11 12:53:12 +02:00 · 51e65be98b
commit 51e65be98b
parent 81693d81b6
1 changed files with 1 additions and 3 deletions
--- a/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
+++ b/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
@ -19,10 +19,8 @@ detection:
            - '* -encodedcommand JAB*'
            - '* BA^J e-'
    falsepositive1:
-        Image: '*\GRR\\*'
-    falsepositive2:
        CommandLine: '* -ExecutionPolicy remotesigned *'
-    condition: selection and not 1 of falsepositive*
+    condition: selection and not falsepositive1
 falsepositives:
    - GRR powershell hacks
    - PowerSponse Deployments