Powershell Win32_PnPEntity Discovery

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects PowerShell script block text containing "Win32_PnPEntity". This WMI class is used to query information about Plug and Play devices, which can include peripheral devices. Adversaries may use this to gather information about attached peripheral devices and components connected to a computer system for discovery purposes.