Rule Library
Sigma Rules
2 rules found for "memory-shards"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectionmediumtest
AgentExecutor PowerShell Execution
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
WindowsProcess Creation
Nasreddine Bencherchali (Nextron Systems)+1Sat Dec 24windows
Detectionhightest
Suspicious AgentExecutor PowerShell Execution
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
WindowsProcess Creation
Nasreddine Bencherchali (Nextron Systems)+1Sat Dec 24windows