PowerShell Credential Prompt Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

This rule detects the use of 'PromptForCredential' within PowerShell script block logs. This function is used to display a dialog box that prompts the user for credentials, which can be abused by adversaries to harvest user credentials. Detection relies on PowerShell Script Block Logging being enabled.