All Detections

HackTool - Evil-WinRm Execution - PowerShell Module

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 20252026

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

Sigma