Sagan unknown stable other

[WINDOWS-POWERSHELL] Possible Windows Policy Enumeration

[WINDOWS-POWERSHELL] Possible Windows Policy Enumeration

View Source

Detection Logic

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-POWERSHELL] Possible Windows Policy Enumeration"; program:*PowerShell*; event_id:4103; content:"
| 5c
| Software
| 5c
| Microsoft
| 5c
| Windows
| 5c
| CurrentVersion
| 5c
| Policies
| 5c
| Explorer
| 5c
| "; classtype:credential-access; sid:5015516; rev:1; metadata:created_at 2025_03_06, updated_at 2025_03_06, mitre_tactic_id TA0006, mitre_technique_id T1649;)

Field Validations

Loading…

Comments (0)

Loading comments...