HackTool - WinPwn Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•1•0•34

Detects command-line keywords indicative of the execution of the WinPwn tool, which is used for Windows and Active Directory reconnaissance and exploitation. This rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' in the command line.