hard20 pts · first answer countsdetection-engineeringdetection-evasionprocess-lineage
Caret tricks in cmd.exe
A rule looks for `CommandLine|contains: 'powershell'` on cmd.exe events. The attacker runs `cmd /c p^o^w^e^r^s^h^e^l^l -enc ...`. What happens?
Discussion 0
Join free to post in the discussion.
Related questions
- False positive or false negative?Cybersecurity Analyst
- What detection as code gives youCybersecurity Analyst
- The logsource block in a Sigma ruleCybersecurity Analyst
- Reading a selection and filter conditionCybersecurity Analyst
- What the contains modifier doesCybersecurity Analyst
- Why match Image with endswithCybersecurity Analyst
- Reading an ATT&CK ID like T1059.001Cybersecurity Analyst
- Run keys and the Persistence tacticCybersecurity Analyst