We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 9d1b5b0 commit 1b5b3acCopy full SHA for 1b5b3ac
detections/endpoint/windows_powershell_process_with_malicious_string.yml
@@ -52,21 +52,14 @@ rba:
52
tags:
53
analytic_story:
54
- Malicious PowerShell
55
- asset_type: Endpoint
56
- message:
+ asset_type: Endpoint
57
mitre_attack_id:
58
- T1059
59
- T1059.001
60
product:
61
- Splunk Enterprise
62
- Splunk Enterprise Security
63
- Splunk Cloud
64
- required_fields:
65
- - Processes.user
66
- - Processes.dest
67
- - Processes.process_name
68
- - Processes.process
69
- - Processes.parent_process_name
70
security_domain: threat
71
tests:
72
- name: True Positive Test
0 commit comments