Moonrise RAT - Unauthorized Peripheral Hardware Enumeration
Detects the enumeration of camera or microphone hardware using the 'Get-PnpDevice' PowerShell cmdlet. This behavior is a precursor to surveillance activities such as webcam capture or audio recording and has been associated with the Moonrise RAT.
Microsoft Sentinel (KQL)
