Pua And Product Edition Discovery Via Command Line
This rule detects command-line executions that query for Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition information. This activity is often performed by adversaries during the discovery phase to understand the environment and tailor subsequent actions. The rule specifically looks for `reg`, `powershell`, `pwsh`, or `wmic` commands containing keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid'.
YARA-L
