PowerShell OleViewDotNet/NtObjectManager Dangling COM Enumeration
Detects the use of PowerShell to perform COM database enumeration, often associated with OleViewDotNet or NtObjectManager tools, specifically looking for indicators of COM object querying such as InProcServer32 path identification.
Sigma
