Netcat The Powershell Version
This rule detects the use of 'powercat' or 'powercat.ps1' within PowerShell classic logs. Powercat is a PowerShell-based network utility similar to Netcat, often used by adversaries for network communication, including reverse shells, bind shells, and file transfers, potentially bypassing traditional network controls. This activity is indicative of command and control communication or lateral movement using non-application layer protocols.
Sigma
