Skip to content

Commit bb8a0ae

Browse files
authored
Update posh_ps_mfa_requirement_tampering.yml
1 parent 865c4a0 commit bb8a0ae

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

rules/windows/powershell/powershell_script/posh_ps_mfa_requirement_tampering.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,10 @@ detection:
2424
ScriptBlockText|contains: 'StrongAuthenticationRequirements'
2525
selection_clear:
2626
ScriptBlockText|contains:
27-
- '= $null'
28-
- '= @()'
27+
- '$null'
28+
- '@()'
2929
- '.Clear()'
3030
condition: all of selection_*
3131
falsepositives:
3232
- Legitimate administration scripts resetting a user's MFA methods at their request
33-
level: high
33+
level: high

0 commit comments

Comments
 (0)