PSAsyncShell - Asynchronous TCP Reverse Shell Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects the use of 'PSAsyncShell', an asynchronous TCP reverse shell written in PowerShell. The rule specifically looks for the string 'PSAsyncShell' within PowerShell script block logs, indicating the execution or presence of this specific tool.