Skip to content

Update IF's Message#4142

Merged
patel-bhavin merged 3 commits into
developfrom
remove-scriptblocktext
Jul 1, 2026
Merged

Update IF's Message#4142
patel-bhavin merged 3 commits into
developfrom
remove-scriptblocktext

Conversation

@nasbench

@nasbench nasbench commented Jun 29, 2026

Copy link
Copy Markdown
Contributor

This PR updates the IF's message for analytics leveraging the Pwsh ScriptBlock datasource.
Due to a visual bug that could occur with large ScriptBlockText fields, its preferable to not omit it as part of the Finding/IF message.

I also took the opportunity to update the type of these analytics to anomaly as as well as adjust their message description.

Updated Analytics [9]

  • powershell_domain_enumeration
  • powershell_environment_variable_execution
  • powershell_loading_dotnet_into_memory_via_reflection
  • powershell_processing_stream_of_data
  • powershell_remove_windows_defender_directory
  • powershell_windows_defender_exclusion_commands
  • windows_clipboard_data_via_get_clipboard
  • windows_powershell_import_applocker_policy
  • windows_powershell_logoff_user_via_quser

See TR-4471

@nasbench nasbench changed the title update IF config Update IF message Jun 29, 2026
@nasbench nasbench changed the title Update IF message Update IF's Message Jun 29, 2026
@nasbench nasbench added this to the V6.2.0 milestone Jun 29, 2026
@nasbench nasbench marked this pull request as ready for review June 29, 2026 14:36
@patel-bhavin

Copy link
Copy Markdown
Contributor

Looking good @nasbench :approved:

@patel-bhavin patel-bhavin enabled auto-merge (squash) July 1, 2026 09:17
@patel-bhavin patel-bhavin merged commit bf13c80 into develop Jul 1, 2026
6 checks passed
@patel-bhavin patel-bhavin deleted the remove-scriptblocktext branch July 1, 2026 09:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants