Rule Info
Name
Potential Suspicious PowerShell Script Executed
Author
Nasreddine Bencherchali (Nextron Systems)
Description
Detects the execution of potential suspicious PowerShell scripts residing in suspicious paths
Reference
Internal Research
Date
2023-02-01 00:00:00
Modified
2023-03-29 00:00:00
Id
b6bb9f90-008d-4381-bb95-fe5a9edce6d2
Tags
attack.execution attack.t1059.001
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR