Rule Info
Name
PowerShell Web Access Installation - PsScript
Author
Michael Haag
Description
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse
Reference
Date
2024-09-03 00:00:00
Modified
None
Id
5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f
Tags
attack.persistence attack.t1059.001 DEMO
Type
Community Rule
Link to Public Repo
Rule History
Author
Title
Date
Commit
Michael Haag
Merge PR #4997 from @MHaggis - Add rules related to PowerShell Web Access
2024-09-03
Scan your endpoints, forensic images or collected files with our portable scanner THOR