admin/hunters-forge-OSSEM
1
0
Fork 0
mirror of https://github.com/hunters-forge/OSSEM synced 2026-06-08 14:44:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

added powershell w/o descriptions

Browse Source
This commit is contained in:
bfuzzy
2018-05-22 11:21:07 -04:00
committed by GitHub
parent 9613b1b17e
commit bbd082dfaf
1 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detection_data_model/data_objects/powershell.md
+32
View File
@@ -0,0 +1,32 @@
| Standard Name | Field Name | Type | Description | Sample Value |
| ---------------- | ---------------- | ---------------- | ---------------- | ---------------- |
| powershell\_new_engine\_state | NewEngineState | string | | Available |
| powershell\_previous\_engine\_state | PreviousEngineState | string | | None |
| powershell\_sequence\_number | SequenceNumber | integer | | 13 |
| powershell\_host\_name | HostName | string | | ConsoleHost |
| powershell\_host\_version | HostVersion | string | | 5.1.16299.251 |
| powershell\_host\_id | HostId | string | | f90b931a-dc4d-488a-b1b8-e0b7dbcdc0c7 |
| powershell\_host\_application | HostApplication | string | | powershell.exe |
| powershell\_engine\_version | EngineVersion | string | | 5.1.16299.251 |
| powershell\_runspace\_id | RunspaceId | string | | 0dfc1f10-3bce-4885-8dbf-58ed28eba179 |
| powershell\_pipeline\_id | PipelineId | integer | | |
| powershell\_command\_name | CommandName | string | | |
| powershell\_command\_type | CommandType | string | | |
| powershell\_script\_name | ScriptName | string | | |
| powershell\_command\_path | CommandPath | string | | |
| powershell\_command\_line | CommandLine | string | | |
| powershell\_command\_invocation | CommandInvocation | string | | Get-ChildItem |
| powershell\_parameter\_binding | ParameterBinding | string | | Filter |
| powershell\_severity | Severity | string | | Informational |
| powershell\_sequence\_number | Sequence Number | string | | 88 |
| user\_name | User | string | | wardog |
| user\_domain | User | string | | DESKTOP-WARDOG |
| powershell\_connected\_user | Connected User | string | | |
| powershell\_shell\_id | Shell ID | string | | Microsoft.PowerShell |
| powershell\_message\_number | MessageNumber | integer | | 1 |
| powershell\_parameter\_binding | MessageTotal | integer | | 1 |
| powershell\_scriptblock\_text | ScriptBlockText | string | | function Invoke-ATTACKAPI.. |
| powershell\_scriptblock\_id | ScriptBlockId | string | | 1c97482f-51a2-4cf9-8abd-df9769b6e373 |
| powershell\_Path | Path | string | | C:\Tools\Invoke-ATTACKAPI-master\Invoke-ATTACKAPI.ps1 |
| event\_provider\_name | ProviderName | string | | Variable |
| powershell\_new\_provider\_state | NewProviderState | string | | Started |