HackTool - WinPwn Execution - ScriptBlock

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•1•0•28

Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.