LoFP LoFP / t1518

t1518

TitleTags
as the \"selection_cmdlet\" is common in scripts the matching engine might slow down the search. change into regex or a more accurate string to avoid heavy resource consumption if experienced
as the script block is a blob of text. false positive may occur with scripts that contain the keyword as a reference or simply use it for detection.
endpoint security installers, updaters and post installation verification scripts.
false positives might occur due to the nature of the scriptblock being ingested as a big blob. initial tuning is required.
legitimate activities
legitimate administration activities