From 0e38e92e4e9ec9352d97efe322c58f70b060ea87 Mon Sep 17 00:00:00 2001 From: reece394 <31659691+reece394@users.noreply.github.com> Date: Tue, 10 Nov 2026 21:33:36 +0000 Subject: [PATCH] Implement Fix for PowerShell_Engine_State rules --- ..._400_powershell_engine_state_available.yml | 36 +++++++++---------- ...id_403_powershell_engine_state_stopped.yml | 36 +++++++++---------- 2 files changed, 36 insertions(+), 36 deletions(-) diff --git a/rules/evtx/powershell/eid_400_powershell_engine_state_available.yml b/rules/evtx/powershell/eid_400_powershell_engine_state_available.yml index 30c5decb..7f723442 100644 --- a/rules/evtx/powershell/eid_400_powershell_engine_state_available.yml +++ b/rules/evtx/powershell/eid_400_powershell_engine_state_available.yml @@ -21,76 +21,76 @@ fields: to: Event.System.Computer - name: HostName container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: HostName - from: Event.EventData.Data[2].HostName + from: Event.EventData.Data.#text[2].HostName - name: HostVersion container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: HostVersion - from: Event.EventData.Data[2].HostVersion + from: Event.EventData.Data.#text[2].HostVersion - name: HostApplication container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: HostApplication - from: Event.EventData.Data[2].HostApplication + from: Event.EventData.Data.#text[2].HostApplication - name: PipelineId container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: PipelineId - from: Event.EventData.Data[2].PipelineId + from: Event.EventData.Data.#text[2].PipelineId - name: CommandName container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandName - from: Event.EventData.Data[2].CommandName + from: Event.EventData.Data.#text[2].CommandName - name: CommandType container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandType - from: Event.EventData.Data[2].CommandType + from: Event.EventData.Data.#text[2].CommandType - name: ScriptName container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: ScriptName - from: Event.EventData.Data[2].ScriptName + from: Event.EventData.Data.#text[2].ScriptName - name: CommandPath container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandPath - from: Event.EventData.Data[2].CommandPath + from: Event.EventData.Data.#text[2].CommandPath - name: CommandLine container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandLine - from: Event.EventData.Data[2].CommandLine + from: Event.EventData.Data.#text[2].CommandLine filter: condition: powershell diff --git a/rules/evtx/powershell/eid_403_powershell_engine_state_stopped.yml b/rules/evtx/powershell/eid_403_powershell_engine_state_stopped.yml index e6f2b151..b37ee432 100644 --- a/rules/evtx/powershell/eid_403_powershell_engine_state_stopped.yml +++ b/rules/evtx/powershell/eid_403_powershell_engine_state_stopped.yml @@ -21,76 +21,76 @@ fields: to: Event.System.Computer - name: HostName container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: HostName - from: Event.EventData.Data[2].HostName + from: Event.EventData.Data.#text[2].HostName - name: HostVersion container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: HostVersion - from: Event.EventData.Data[2].HostVersion + from: Event.EventData.Data.#text[2].HostVersion - name: HostApplication container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: HostApplication - from: Event.EventData.Data[2].HostApplication + from: Event.EventData.Data.#text[2].HostApplication - name: PipelineId container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: PipelineId - from: Event.EventData.Data[2].PipelineId + from: Event.EventData.Data.#text[2].PipelineId - name: CommandName container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandName - from: Event.EventData.Data[2].CommandName + from: Event.EventData.Data.#text[2].CommandName - name: CommandType container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandType - from: Event.EventData.Data[2].CommandType + from: Event.EventData.Data.#text[2].CommandType - name: ScriptName container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: ScriptName - from: Event.EventData.Data[2].ScriptName + from: Event.EventData.Data.#text[2].ScriptName - name: CommandPath container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandPath - from: Event.EventData.Data[2].CommandPath + from: Event.EventData.Data.#text[2].CommandPath - name: CommandLine container: - field: Event.EventData.Data[2] + field: Event.EventData.Data.#text[2] format: kv delimiter: "\r\n\t" separator: '=' to: CommandLine - from: Event.EventData.Data[2].CommandLine + from: Event.EventData.Data.#text[2].CommandLine filter: condition: powershell