| splunk |
Possible Lateral Movement PowerShell Spawn |
production |
2026-10-09 |
| elastic |
Incoming Execution via PowerShell Remoting |
production |
2026-10-06 |
| elastic |
Potential PowerShell HackTool Script by Function Names |
production |
2026-09-18 |
| elastic |
Incoming Execution via WinRM Remote Shell |
production |
2026-09-18 |
| splunk |
Interactive Session on Remote Endpoint with PowerShell |
production |
2026-05-13 |
| splunk |
Powershell Remote Services Add TrustedHost |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WinRM and PowerShell |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WinRM and PowerShell Script Block |
production |
2026-05-13 |
| splunk |
Remote Process Instantiation via WinRM and Winrs |
production |
2026-05-13 |
| splunk |
Windows Remote Host Computer Management Access |
production |
2026-05-13 |
| splunk |
Windows Remote Management Execute Shell |
production |
2026-05-13 |
| splunk |
Wsmprovhost LOLBAS Execution Process Spawn |
production |
2026-05-13 |
| sigma |
OMIGOD HTTP No Authentication RCE - CVE-2021-38647 |
stable |
2025-11-03 |
| sigma |
Winrs Local Command Execution |
experimental |
2025-10-22 |
| sigma |
Potential Lateral Movement via Windows Remote Shell |
experimental |
2025-10-22 |
| sigma |
Potential Remote PowerShell Session Initiated |
test |
2024-02-02 |
| sigma |
Remote PowerShell Session (PS Classic) |
test |
2024-01-03 |
| sigma |
Remote LSASS Process Access Through Windows Remote Management |
stable |
2023-11-29 |
| sigma |
HackTool - WinRM Access Via Evil-WinRM |
test |
2023-02-13 |
| sigma |
Remote PowerShell Session (PS Module) |
test |
2023-01-20 |
| sigma |
Remote PowerShell Session Host Process (WinRM) |
test |
2022-10-09 |
| sigma |
Enable Windows Remote Management |
test |
2022-01-07 |
| sigma |
Execute Invoke-command on Remote Host |
test |
2022-01-07 |