Rule Library
Sigma Rules
3 rules found for "Sean Metcalf (source)"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionhightest
PowerShell Called from an Executable Version Mismatch
Detects PowerShell called from an executable by the version mismatch method
WindowsPowerShell Classic
Sean Metcalf (source)+1Sun Mar 05windows
Detectionmediumtest
Malicious PowerShell Keywords
Detects keywords from well-known PowerShell exploitation frameworks
WindowsPowerShell Script
Sean Metcalf (source)+1Sun Mar 05windows
Detectionhightest
PowerShell PSAttack
Detects the use of PSAttack PowerShell hack tool
WindowsPowerShell Script
Sean Metcalf (source)+1Sun Mar 05windows