Merge pull request SigmaHQ#1254 from Neo23x0/rule-devel

Rule devel
lukiffer · Oct 20, 2020 · e7462be · e7462be
2 parents 75f1772 + ee789a3
commit e7462be
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/rules/windows/powershell/powershell_nishang_malicious_commandlets.yml b/rules/windows/powershell/powershell_nishang_malicious_commandlets.yml
@@ -75,7 +75,6 @@ detection:
         - TexttoExe
         - Powerpreter
         - Nishang
-        - EncodedData
         - DataToEncode
         - LoggedKeys
         - OUT-DNSTXT

diff --git a/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml b/rules/windows/process_creation/win_susp_powershell_enc_cmd.yml
@@ -6,7 +6,7 @@ references:
     - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
 author: Florian Roth, Markus Neis
 date: 2018/09/03
-modified: 2019/12/16
+modified: 2020/10/20
 tags:
     - attack.execution
     - attack.t1059.001
@@ -36,6 +36,10 @@ detection:
             - '* -enc aWV4I*'
             - '* -enc SQBFAFgA*'
             - '* -enc aQBlAHgA*'
+            - '* -e* IAA*'
+            - '* -e* IAB*'
+            - '* -e* UwB*'
+            - '* -e* cwB*'
     falsepositive1:
         CommandLine: '* -ExecutionPolicy remotesigned *'
     condition: selection and not falsepositive1