Abuse Melding

Je hebt een klacht over de onderstaande posting:

19-05-2023, 14:05 door Anoniem

Gebruik name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 version: 3 date: '2023-04-14' author: Michael Haag, Splunk status: production type: Hunting description: The following Hunting analytic assists with identifying suspicious PowerShell execution using Script Block Logging, or EventCode 4104. This analytic is not meant to be ran hourly, but occasionally to identify malicious or suspicious PowerShell. This analytic is a combination of work completed by Alex Teixeira and Splunk Threat Research Team. data_source: - Powershell 4104 search: '`powershell` EventCode=4104 | eval DoIt = if(match(ScriptBlockText,"(?i)(\$doit)"), "4", 0) | eval enccom=if(match(ScriptBlockText,"[A-Za-z0-9+\/]{44,}([A-Za-z0-9+\/]{4}|[A-Za-z0-9+\/]{3}=|[A-Za-z0-9+\/]{2}==)") OR match(ScriptBlockText, "(?i)[-]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]"),4,0) | eval suspcmdlet=if(match(ScriptBlockText, ...

Beschrijf je klacht (Optioneel):

captcha
Nieuwe code
Klacht Versturen
Zoeken
search