Rule Info
Name
PowerShell Restart Windows Defender
Author
X__Junior (Nextron Systems)
Description
Detects powershell restarting services related to Windows Defender
Reference
Date
2024-09-10 00:00:00
Modified
None
Id
0bd8d8d7-0fe0-4bf7-b42f-fd829eb73942
Tags
attack.credential-access attack.t1003.001
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR