Invoke-TheHash SMBExec/WMIExec and GodPotato execution on same device

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•1•0•2

Detects the correlation of pass-the-hash execution tooling (such as Invoke-TheHash, Invoke-SMBExec, or Invoke-WMIExec) followed by the execution of the GodPotato privilege escalation exploit on the same device within a 24-hour timeframe.