island: Modify mongo query so 'Account Discovery' PBA also gets reported in T1086

2021-10-13 13:37:39 +05:30 · 2021-10-13 13:37:39 +05:30 · effd9dd957
parent e3045c255a
commit effd9dd957
1 changed files with 1 additions and 0 deletions
--- a/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
+++ b/monkey/monkey_island/cc/services/attack/technique_reports/T1086.py
@ -42,6 +42,7 @@ class T1086(AttackTechnique):
                "telem_category": "post_breach",
                "$or": [
                    {"data.command": {"$regex": r"\.ps1"}},
+                    {"data.command": {"$regex": "powershell"}},
                    {"data.result": {"$regex": r"\.ps1"}},
                ],
            },