Sagan high stable other

[WINDOWS-POWERSHELL] Powershell StrReverse Obfuscation

[WINDOWS-POWERSHELL] Powershell StrReverse Obfuscation

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-POWERSHELL] Powershell StrReverse Obfuscation"; program: *PowerShell*; json_map:"event_id",".EventID"; json_map:"message",".RenderedDescription"; event_id:400,800,4103,4104; content:"StrReverse
| 28
| "; nocase; content:"llehSrewoP"; nocase; reference:url,bazaar.abuse.ch/download/aa87d136aacebb0496371be929657834d541209ef53695e45dc0acc8b65663a7/; classtype:suspicious-command; sid:5009348; metadata: created_on 2022_11_22, old_sid 5007135; rev:1;)

Field Validations

Loading…

Comments (0)

Loading comments...