Windows PowerShell Logoff User via Quser and Logoff Commands

This analytic detects the use of PowerShell to execute the 'quser' and 'logoff' commands in sequence. This combination indicates an attempt to identify active user sessions and then forcibly terminate one or more of them. This activity could be part of legitimate administrative tasks, but it can also be indicative of unauthorized access attempts, session manipulation, or an adversary attempting to disrupt user access or cover their tracks. Monitoring for this pattern helps identify potential misuse or malicious activity where a user's access is revoked without proper authorization.