icedid_mod_sig

detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml

@@ -11,7 +11,7 @@ description: The following analytic identifies suspicious PowerShell script exec
   adversary will map all running security applications or services. During triage,
   review parallel processes within the same timeframe. Review the full script block
   to identify other related artifacts.
-search: '`powershell` EventCode=4104 Message = "*SELECT*" AND (Message = "*AntiVirusProduct*"
+search: '`powershell` EventCode=4104 (Message = "*SELECT*" OR Message = "*WMIC*") AND (Message = "*AntiVirusProduct*"
   OR Message = "*AntiSpywareProduct*") | stats count min(_time) as firstTime max(_time)
   as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `recon_avproduct_through_pwh_or_wmi_filter`'