Threat detection EQL error

zhixiang_hao · September 13, 2022, 6:50am

Does anyone know what's causing it?

justin_ibarra · September 13, 2022, 10:51pm

Hi there, it looks like you are mixing up syntax in that field with KQL syntax. Correct usage would be:

powershell.file.script_block_text : ("MiniDumpWriteDump", "MiniDumpWithFullMemory", "pmuDetirWpmuDiniM")

zhixiang_hao · September 14, 2022, 1:19am

哈哈，i'm sorry,thank you help me

system · October 12, 2022, 1:20am

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.