Sagan high stable other

[WINDOWS-POWERSHELL] PowerShell Auto Login Enabled, Possible Persistance Attempt [1/2]

[WINDOWS-POWERSHELL] PowerShell Auto Login Enabled, Possible Persistance Attempt [1/2]

View Source

Detection Logic

alert any $HOME_NET any -> $EXTERNAL_NET any (msg:"[WINDOWS-POWERSHELL] PowerShell Auto Login Enabled, Possible Persistance Attempt [1/2]"; event_id: 4104; program: *PowerShell*; content: "Set-ItemProperty -Path
| 22
| HKLM:\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
| 22
| "; content: !"Base Image Script Framework"; classtype: suspicious-command; reference: url,github.com/SigmaHQ/sigma/blob/cd71edc09ca915f389e50df5b1bbb5ecd4b7f89d/rules/windows/powershell/powershell_script/posh_ps_winlogon_helper_dll.yml; sid:5005756; rev:3; metadata:updated_at 2025_05_13, mitre_tactic_id TA0003, mitre_technique_id T1547.004;)

Field Validations

Loading…

Comments (0)

Loading comments...