PowerShell WMI Win32_ComputerSystem domain query for domain identification
Detects the use of PowerShell to execute WMI queries against the Win32_ComputerSystem class to identify domain membership information. This is a common discovery technique used by attackers to profile the environment and understand network context.
Sigma
