PowerShell PSAttack Tool Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the use of the PSAttack PowerShell hack tool by looking for the specific string 'PS ATTACK!!!' within PowerShell script block logs. This tool is often used for post-exploitation activities.