rule: minor improvement to susp ps enc cmd

2024-11-07 09:48:58 +00:00 · 2019-09-04 16:31:49 +02:00 · 2019-09-04 16:31:49 +02:00 · 7bef822da7
commit 7bef822da7
parent 03d45d57de
1 changed files with 1 additions and 0 deletions
--- a/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
+++ b/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
@ -22,6 +22,7 @@ detection:
            - '* -e     JAB*'
            - '* -e      JAB*'
            - '* -enc JAB*'
+            - '* -enco JAB*'
            - '* -encodedcommand JAB*'
            - '* BA^J e-'
            - '* -e SUVYI*'