Covenant PowerShell Launcher Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects suspicious command lines commonly used by Covenant C2 framework launchers, specifically looking for PowerShell execution with hidden window styles and encoded commands, or specific Covenant-related strings like 'GruntHTTP'.