HackTool - WinRM Access Via Evil-WinRM
This rule detects the execution of `ruby.exe` with command-line arguments indicative of Evil-WinRM usage. Specifically, it looks for the presence of `-i`, `-u`, and `-p` flags, which are commonly used by Evil-WinRM for specifying the target IP address, username, and password for Windows Remote Management (WinRM) access. This activity suggests an adversary is attempting to establish remote control over a system using a known penetration testing tool.
Sigma
