Remote Command Execution via Invoke-Command
This rule detects the execution of the PowerShell cmdlet 'Invoke-Command' with the '-ComputerName' parameter. This combination indicates an attempt to execute commands on a remote host using Windows Remote Management (WinRM). Adversaries commonly use this technique for lateral movement within a network after gaining valid credentials.
Sigma
