To create a new rule, click the Create New Rule action located in the upper- left corner of the grid. A new view appears with which you can provide all the details for the new rule. After entering your details, submit the rule to be saved. Your new rule is picked up by the IOC Streaming module.
The lower section of this view is dedicated to the definition of the conditions to attach to the rule. For each condition you specify the test(s) to apply to an event, all of which must be true for the match to occur. For a rule with multiple conditions, any of the conditions can be true for a match to occur.
The rule will match when:
An instance of an ImageLoadEvent has the Process attribute equal to pwsh.exe (case sensitive), AND that same event has a Filename attribute that contains system.directoryservices.dll (case sensitive)
OR
An instance of an ImageLoadEvent has the Process attribute equal to powershell.exe (case sensitive), AND that same event has a Filename attribute that contains system.directoryservices.dll (case sensitive)
When working with conditions you can:
Add a new condition by clicking the Add Condition + action at the bottom of the view
Remove a condition (and all its tests) by clicking the Remove action in the top row of the condition When working with the tests within a condition you can
Add a new test by clicking the + action to the right of the Matching Value entry field
Remove a test by clicking the Remove action in the row of the test to remove
Note
If you do not Submit your updates, they will not be saved.