Suspicious Computer Machine Password Reset via PowerShell
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
Sigma
