17 published detections cite this
Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.
| Detection | Severity |
|---|---|
| Powershell Get LocalGroup Discovery with Script Block Logging | Medium |
| Get WMIObject Group Discovery with Script Block Logging | Medium |
| Unloading AMSI via Reflection | Medium |
| ServicePrincipalNames Discovery with PowerShell | Medium |
| Recon Using WMI Class | Informational |
| Recon AVProduct Through Pwh or WMI | Medium |
| Powershell Using memory As Backing Store | Medium |
| Powershell Processing Stream Of Data | Informational |
| PowerShell Loading DotNET into Memory via Reflection | Informational |
| Powershell Fileless Script Contains Base64 Encoded Content | Medium |
| Powershell Fileless Process Injection via GetProcAddress | Medium |
| PowerShell Environment Variable Execution | Informational |
| PowerShell Domain Enumeration | Informational |
| Powershell Creating Thread Mutex | Medium |
| Get-DomainTrust with PowerShell Script Block | Medium |
| Detect Mimikatz With PowerShell Script Block Logging | Medium |
| Detect Empire with PowerShell Script Block Logging | Medium |
Showing 17 of 17