Sagan critical stable other

[WINDOWS-POWERSHELL] Mimikatz Command Line Parameters (sekurlsa::logonpasswords)

[WINDOWS-POWERSHELL] Mimikatz Command Line Parameters (sekurlsa::logonpasswords)

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-POWERSHELL] Mimikatz Command Line Parameters (sekurlsa::logonpasswords)"; program:*PowerShell*; event_id:4103,4104,600,800; content:"sekurlsa::logonpasswords"; nocase; reference:url,adsecurity.org/?page_id=1821; classtype:trojan-activity; sid:5010480; rev:1; metadata:updated_at 2023_10_10, mitre_tactic_id TA0006, mitre_technique_id T1555;)

Field Validations

Loading…

Comments (0)

Loading comments...