| splunk |
Windows System Script Proxy Execution Syncappvpublishingserver |
production |
2026-10-02 |
| elastic |
Delayed Execution via Ping |
production |
2026-09-18 |
| sigma |
Suspicious CustomShellHost Execution |
test |
2025-10-29 |
| sigma |
Uncommon Sigverif.EXE Child Process |
test |
2024-08-27 |
| sigma |
Execute Code with Pester.bat |
test |
2023-11-09 |
| sigma |
Potential Process Execution Proxy Via CL_Invocation.ps1 |
test |
2023-08-17 |
| sigma |
Assembly Loading Via CL_LoadAssembly.ps1 |
test |
2023-08-17 |
| sigma |
Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 |
test |
2023-08-17 |
| sigma |
Remote Code Execute via Winrm.vbs |
test |
2023-03-03 |
| sigma |
Potential Manage-bde.wsf Abuse To Proxy Execution |
test |
2023-02-03 |
| sigma |
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl - File |
test |
2022-11-28 |
| sigma |
AWL Bypass with Winrm.vbs and Malicious WsmPty.xsl/WsmTxt.xsl |
test |
2022-10-09 |
| sigma |
Execute Code with Pester.bat as Parent |
test |
2022-08-20 |
| sigma |
SyncAppvPublishingServer VBS Execute Arbitrary PowerShell Code |
test |
2022-06-22 |
| sigma |
UtilityFunctions.ps1 Proxy Dll |
test |
2022-05-28 |