Cyber falter

@falter

Completionist

0 followers13 downloads2 copies0 likes48 views

1 detection

Filters

Last updated

All Time

Detection languages

Sigma1

Platforms

Windows1

Products / Services

Windows Event Log (PowerShell)1

MITRE Techniques

T1059.001 - PowerShell1

TA0002 - Execution1

PowerShell Reverse Shell Script Block

Sigma

Detects a common PowerShell reverse shell pattern in script block logs (EID 4104). This pattern involves creating a TCP client, getting the network stream, and using Invoke-Expression (iex) to execute commands received over the network.

Cyber falter@falter

Detections.ai Community

8 months ago

2048