HackTool - Evil-WinRM Execution via PowerShell Module
Detects the execution of the Evil-WinRM hack tool by identifying specific hardcoded strings within PowerShell Module logs. This rule looks for patterns associated with Evil-WinRM's functionality, such as specific PowerShell commands for file operations, binary invocation, and registry queries, executed within the context of wsmprovhost.exe.
Sigma
