From 4f774be1b4caf6c7e400a72e2b14a42b7ddfba95 Mon Sep 17 00:00:00 2001 From: TheLawsOfChaos Date: Thu, 2 Feb 2023 12:04:36 -0500 Subject: [PATCH] Update powershell_fileless_script_contains_base64_encoded_content.yml Updated risk message to the new field names. --- ...rshell_fileless_script_contains_base64_encoded_content.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 0e2ca3b843..fbf87bc0fe 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -45,8 +45,8 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: A suspicious powershell script contains base64 command in $Message$ with - EventCode $EventCode$ in host $ComputerName$ + message: A suspicious powershell script contains base64 command in $ScriptBlockText$ with + EventCode $EventCode$ in host $Computer$ mitre_attack_id: - T1059 - T1027