valitydev/SigmaHQ
14
0
Fork 0
mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 17:35:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge pull request #1636 from leegengyu/patch-6

Browse Source 
powershell_data_compressed.yml - Update selection
This commit is contained in:
Florian Roth 2021-07-07 10:12:52 +02:00 committed by GitHub
commit 792f234872
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
rules/windows/powershell/powershell_data_compressed.yml
View File

@ -4,6 +4,7 @@ status: experimental
description: An adversary may compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
author: Timur Zinniatullin, oscd.community
date: 2019/10/21
modified: 2021/07/06
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560/T1560.md
logsource:
@ -13,7 +14,7 @@ logsource:
detection:
selection:
EventID: 4104
keywords|contains|all:
ScriptBlockText|contains|all:
- '-Recurse'
- '|'
- 'Compress-Archive'