| 用途 | 一条检测跨平台回溯 |
|---|---|
| 结构 | logsource / detection / condition |
片段
片段
logsource:
product: windows
category: process_creation
detection:
selection:
Image|endswith: '\powershell.exe'
CommandLine|contains: '-enc'
condition: selection转换后先在 7 天窗跑基线，评误报再扩大时间范围。