Skip to content

Commit a96137f

Browse files
authored
Update windows_powershell_script_block_with_malicious_string.yml
1 parent 1b5b3ac commit a96137f

File tree

1 file changed

+1
-6
lines changed

1 file changed

+1
-6
lines changed

detections/endpoint/windows_powershell_script_block_with_malicious_string.yml

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ rba:
4747
score: 70
4848
threat_objects:
4949
- field: signature_id
50-
type: signature_id
50+
type: signature
5151
tags:
5252
analytic_story:
5353
- Malicious PowerShell
@@ -59,11 +59,6 @@ tags:
5959
- Splunk Enterprise
6060
- Splunk Enterprise Security
6161
- Splunk Cloud
62-
required_fields:
63-
- ActivityID
64-
- Computer
65-
- EventCode
66-
- ScriptBlockText
6762
security_domain: threat
6863
tests:
6964
- name: True Positive Test

0 commit comments

Comments
 (0)