14 published detections cite this
Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.
| Detection | Severity |
|---|---|
| Powershell Execute COM Object | Medium |
| Powershell COM Hijacking InprocServer32 Modification | Medium |
| PowerShell 4104 Hunting | Medium |
| Recon Using WMI Class | Informational |
| Recon AVProduct Through Pwh or WMI | Medium |
| Powershell Processing Stream Of Data | Informational |
| Powershell Fileless Process Injection via GetProcAddress | Medium |
| Powershell Enable SMB1Protocol Feature | Medium |
| PowerShell Domain Enumeration | Informational |
| GetWmiObject User Account with PowerShell Script Block | Medium |
| GetLocalUser with PowerShell Script Block | Medium |
| Get-ForestTrust with PowerShell Script Block | Medium |
| Detect Mimikatz With PowerShell Script Block Logging | Medium |
| Detect Empire with PowerShell Script Block Logging | Medium |
Showing 14 of 14