Skip to content

Commit 1b5b3ac

Browse files
authored
Update windows_powershell_process_with_malicious_string.yml
1 parent 9d1b5b0 commit 1b5b3ac

File tree

1 file changed

+1
-8
lines changed

1 file changed

+1
-8
lines changed

detections/endpoint/windows_powershell_process_with_malicious_string.yml

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -52,21 +52,14 @@ rba:
5252
tags:
5353
analytic_story:
5454
- Malicious PowerShell
55-
asset_type: Endpoint
56-
message:
55+
asset_type: Endpoint
5756
mitre_attack_id:
5857
- T1059
5958
- T1059.001
6059
product:
6160
- Splunk Enterprise
6261
- Splunk Enterprise Security
6362
- Splunk Cloud
64-
required_fields:
65-
- Processes.user
66-
- Processes.dest
67-
- Processes.process_name
68-
- Processes.process
69-
- Processes.parent_process_name
7063
security_domain: threat
7164
tests:
7265
- name: True Positive Test

0 commit comments

Comments
 (0)