valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-07 09:48:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1263 from Neo23x0/rule-devel

Browse Source 
feat: cover newest emotet campaigns
This commit is contained in:
Florian Roth 2020-10-24 00:02:39 +02:00 committed by GitHub
commit 6f9aeb5ea9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
View File

@ -40,6 +40,7 @@ detection:
- '* -e* IAB*'
- '* -e* UwB*'
- '* -e* cwB*'
- '*.exe -ENCOD *'
falsepositive1:
CommandLine: '* -ExecutionPolicy remotesigned *'
condition: selection and not falsepositive1