T1086 powershell

[VakarisZ]

Feature

Powershell attack technique gets reported.

[itaymmguardicore]

Any good reason to change this? And specifically in this branch?

[VakarisZ]

No. Needed this bugfix to test and forgot to revert. Bugfix will be included in new weblogic exploiter.

[itaymmguardicore]

If you fixed things before, don't forget to push the changes.
Also adapt add_example_cmd to include the shell type when you add a new command.
To be clear, add_example_cmd doesn't need to receive the type as a parameter (unless it makes it easier/more accurate), you just need to detect the type like you detect powershell right now.
An entry in the cmds array will look something like:
{'cmd': 'dir C:\', 'shell_type': 'cmd'} or like this {'cmd': 'Get-Service WinDefend', 'shell_type': 'powershell'}

[VakarisZ]

If you fixed things before, don't forget to push the changes.
Also adapt add_example_cmd to include the shell type when you add a new command.
To be clear, add_example_cmd doesn't need to receive the type as a parameter (unless it makes it easier/more accurate), you just need to detect the type like you detect powershell right now.
An entry in the cmds array will look something like:
{'cmd': 'dir C:\', 'shell_type': 'cmd'} or like this {'cmd': 'Get-Service WinDefend', 'shell_type': 'powershell'}

Why do we need the shell_type? I think powershell flag in command is enough.