All Detections

PowerShell ADRecon Execution

avatar
SigmaHQ Detections@sigmaHQ
updated Aug 12, 2024000

Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7

Sigma