12 published detections cite this
Citing it, not covering it: each of these was written with this as evidence, and carries the source it came from and the licence it was published under.
| Detection | Severity |
|---|---|
| Windows WMI Process Call Create | Medium |
| Windows Sensitive Group Discovery With Net | Informational |
| Windows Group Discovery Via Net | Medium |
| Windows File Download Via PowerShell | Informational |
| Windows AdFind Exe | Medium |
| Remote WMI Command Attempt | Medium |
| Network Share Discovery Via Dir Command | Medium |
| Network Connection Discovery With Arp | Medium |
| Powershell Using memory As Backing Store | Medium |
| Powershell Processing Stream Of Data | Informational |
| Powershell Fileless Script Contains Base64 Encoded Content | Medium |
| Executable File Written in Administrative SMB Share | Medium |
Showing 12 of 12