Rule Info
Name
Malicious PowerShell Commandlets - PoshModule
Description
Detects Commandlet names from well-known PowerShell exploitation frameworks
Reference
Modified
2023-01-23 00:00:00
Date
2023-01-20 00:00:00
Author
Nasreddine Bencherchali (Nextron Systems)
Tags
attack.t1087.002 attack.execution attack.t1069.002 attack.t1482 attack.t1059.001 attack.t1087.001 attack.t1069.001 attack.discovery attack.t1069 attack.t1087 DEMO
Id
7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
Type
Community Rule
Link to Public Repo
Rule History
Author
Commit
Title
Date
Scan your endpoints, forensic images or collected files with our portable scanner THOR