The Gentlemen - PowerShell Web Access Installation

Georg Lauenstein@gsec

•updated Mar 25, 2026•0•57

Detects installation of Windows PowerShell Web Access (PSWA) feature, used by The Gentlemen for persistent web-based PowerShell access. They add wildcard authorization rules allowing all users on all computers.