Threat detection EQL error

Does anyone know what's causing it?

:wave: Hi there, it looks like you are mixing up syntax in that field with KQL syntax. Correct usage would be:

powershell.file.script_block_text : ("MiniDumpWriteDump", "MiniDumpWithFullMemory", "pmuDetirWpmuDiniM")

哈哈,i'm sorry,thank you help me

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.