PUA - PingCastle Execution From Potentially Suspicious Parent

SigmaHQ Detections@sigmaHQ

•updated Dec 1, 2024•0•0•0

Detects the execution of PingCastle, a tool designed to quickly assess the Active Directory security level via a script located in a potentially suspicious or uncommon location.