Net WebClient Casing Anomalies

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques