1
0
Форкнуть 0

Change the format ro align it with others query

Chage the format from KUSTO to Query in order to standardize the layout
This commit is contained in:
darioongit 2021-07-08 17:14:15 +02:00 коммит произвёл GitHub
Родитель 5d28ea47b8
Коммит 51d1283363
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
1 изменённых файлов: 3 добавлений и 2 удалений

Просмотреть файл

@ -2,11 +2,12 @@
This query searches for a string pattern detected in evasive PowerShell usage. Jupyter or SolarMarker will iterate on this pattern multiple times to read data and call additional processes. This query is not fully specific to Jupyter or SolarMarker, and will also return other malicious malware, but is unlikely to return false positives.
'''kusto
## Query
```
DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine has_all("-ep bypass","-command","get-content","remove-item","iex")
'''
```
## Category