feat: cover newest emotet campaigns

lukiffer · Oct 23, 2020 · 7563732 · 7563732
1 parent ee789a3
commit 7563732
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml b/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
@@ -40,6 +40,7 @@ detection:
             - '* -e* IAB*'
             - '* -e* UwB*'
             - '* -e* cwB*'
+            - '*.exe -ENCOD *'
     falsepositive1:
         CommandLine: '* -ExecutionPolicy remotesigned *'
     condition: selection and not falsepositive1