Suspicious PrivEsc Tool Fetch Detected
Detects suspicious downloads or fetches of common privilege-escalation tools such as winPEAS, linPEAS, PowerUp, Seatbelt, SharpUp, WinPwn, PrivescCheck, Sherlock, Watson, BeRoot, LinEnum, LSE/LES, Linux Exploit Suggester, pspy, or GTFObins. These tools are often used by adversaries after initial access to enumerate the environment and attempt local privilege escalation.
Microsoft Sentinel (KQL)
