• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Suspicious JScript staging comment

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•21

    Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing identifiable strings in PowerShell commands.

    Microsoft Sentinel (KQL)

    Tags

    TA0002 - ExecutionT1059.001 - PowerShellT1595.002 - Vulnerability ScanningM1016 - Vulnerability ScanningT1588.006 - VulnerabilitiesT1203 - Exploitation for Client ExecutionT1592.004 - Client ConfigurationsT1068 - Exploitation for Privilege EscalationTA0004 - Privilege EscalationS0683 - PeiratesTA0043 - ReconnaissanceTA0042 - Resource DevelopmentPowershell Script ExecutionCommand ExecutionWindowsWindows Defender Atpkqltactic:Executiontactic:Vulnerability

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?