This is a simple application whitelisting daemon for Linux. The dir=untrusted rule macro is deprecated and is planned for removal in the 2.1 release. Existing rules continue to parse for compatibility ...

description: The following analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. It leverages PowerShell ...