Suspicious PowerShell Current User Discovery
Detects the use of PowerShell commands or .NET methods to identify the current logged-in user on a Windows system. This activity is often performed by adversaries during the discovery phase to understand the environment.
Sigma
