Update powershell_shellcode_b64.yml

2024-11-08 02:08:54 +00:00 · 2020-10-15 17:14:01 -03:00 · 2020-10-15 17:14:01 -03:00 · efe9c2d3d6
commit efe9c2d3d6
parent 013533fceb
1 changed files with 5 additions and 5 deletions
--- a/rules/windows/powershell/powershell_shellcode_b64.yml
+++ b/rules/windows/powershell/powershell_shellcode_b64.yml
@ -21,11 +21,11 @@ logsource:
 detection:
    selection:
        EventID: 4104
-    keyword1:
-        - '*AAAAYInlM*'
-    keyword2:
-        - '*OiCAAAAYInlM*'
-        - '*OiJAAAAYInlM*'
+    keyword1|contains:
+        - 'AAAAYInlM'
+    keyword2|contains:
+        - 'OiCAAAAYInlM'
+        - 'OiJAAAAYInlM'
    condition: selection and keyword1 and keyword2
 falsepositives:
    - Unknown