From baaa5bbc73593b6fc0d427826753c7f46a8db8a3 Mon Sep 17 00:00:00 2001
From: SecurityAura <20073832+SecurityAura@users.noreply.github.com>
Date: Sun, 10 Nov 2024 12:31:41 -0500
Subject: [PATCH] Update Runscripthelper.yml (#407)

---
 yml/OSBinaries/Runscripthelper.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/yml/OSBinaries/Runscripthelper.yml b/yml/OSBinaries/Runscripthelper.yml
index d54807b38..95cbcb66b 100644
--- a/yml/OSBinaries/Runscripthelper.yml
+++ b/yml/OSBinaries/Runscripthelper.yml
@@ -19,8 +19,8 @@ Code_Sample:
 Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_runscripthelper.yml
   - BlockRule: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
-  - IOC: Event 4014 - Powershell logging
-  - IOC: Event 400
+  - IOC: Event ID 4104 - Microsoft-Windows-PowerShell/Operational
+  - IOC: Event ID 400 - Windows PowerShell
 Resources:
   - Link: https://posts.specterops.io/bypassing-application-whitelisting-with-runscripthelper-exe-1906923658fc
 Acknowledgement: