ToolShell Post Exploit Mimikatz/PsExec/Impacket Usage
This detection identifies the use of common post-exploitation tools like PsExec, Impacket (specifically WMIExec), and Mimikatz. These tools are frequently used by threat actors for lateral movement and credential access after gaining initial access. The rule looks for specific process names and command-line arguments indicative of these tools.
Splunk (SPL)
