admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update powershell_fileless_script_contains_base64_encoded_content.yml

Browse Source 
Updated risk message to the new field names.
This commit is contained in:
TheLawsOfChaos
2023-02-02 12:04:36 -05:00
committed by GitHub
parent f6f4c306fd
commit 4f774be1b4
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml
+2 -2
View File
@@ -45,8 +45,8 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: A suspicious powershell script contains base64 command in $Message$ with
EventCode $EventCode$ in host $ComputerName$
message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with
EventCode $EventCode$ in host $Computer$
mitre_attack_id:
- T1059
- T1027