From 1941184f9a63fbf6dc35d7c299c69e2312279f6a Mon Sep 17 00:00:00 2001
From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Date: Wed, 5 Apr 2023 16:48:33 -0300
Subject: [PATCH] [Rule Tuning] Potential PowerShell HackTool Script by
 Function Names (#2692)

(cherry picked from commit 1a9b0e732c9e1bc78b97c82121a65a4764467518)
---
 rules/windows/execution_posh_hacktool_functions.toml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rules/windows/execution_posh_hacktool_functions.toml b/rules/windows/execution_posh_hacktool_functions.toml
index caa60f503e7..25d5c790fff 100644
--- a/rules/windows/execution_posh_hacktool_functions.toml
+++ b/rules/windows/execution_posh_hacktool_functions.toml
@@ -2,7 +2,7 @@
 creation_date = "2023/01/17"
 integration = ["windows"]
 maturity = "production"
-updated_date = "2023/02/22"
+updated_date = "2023/04/05"
 min_stack_comments = "New fields added: required_fields, related_integrations, setup"
 min_stack_version = "8.3.0"
 
@@ -152,7 +152,7 @@ event.category:process and host.os.type:windows and
     "Set-DomainObjectOwner" or "Set-DomainUserPassword" or
     "Set-ServiceBinaryPath" or "Sub-SignedIntAsUnsigned" or
     "Test-AdminAccess" or "Test-MemoryRangeValid" or
-    "Test-ServiceDaclPermission" or"Update-ExeFunctions" or
+    "Test-ServiceDaclPermission" or "Update-ExeFunctions" or
     "Update-MemoryAddresses" or "Update-MemoryProtectionFlags" or
     "Write-BytesToMemory" or "Write-HijackDll" or
     "Write-PortscanOut" or "Write-ServiceBinary" or