Rule Library
Sigma Rules
2 rules found for "memory-shards"
3,707Total
3,116Detection
451Emerging
137Hunting
Detectionmediumtest
AgentExecutor PowerShell Execution
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
Nasreddine Bencherchali (Nextron Systems)+1Sat Dec 24windows
Detectionhightest
Suspicious AgentExecutor PowerShell Execution
Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument
WindowsProcess Creation
TA0005 · Defense EvasionT1218 · System Binary Proxy Execution
Nasreddine Bencherchali (Nextron Systems)+1Sat Dec 24windows