Merge pull request #86 from jangeisbauer/patch-13

Create apt ta17 293a ps.txt
microsoft · Apr 22, 2020 · 09d03d1 · 09d03d1
2 parents f623334 + c2bb758
commit 09d03d1
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/Campaigns/apt ta17 293a ps.txt b/Campaigns/apt ta17 293a ps.txt
@@ -0,0 +1,6 @@
+// Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_ta17_293a_ps.yml
+// Questions via Twitter: @janvonkirchheim
+DeviceProcessEvents 
+| where Timestamp > ago(7d)
+| where ProcessCommandLine =~ "ps.exe -accepteula"
+| top 100 by Timestamp desc