Rule Library
Sigma Rules
2 rules found for "ok invrep_de"
3,731Total
3,132Detection
457Emerging
139Hunting
Detectioncriticaltest
Bad Opsec Powershell Code Artifacts
focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.
WindowsPowerShell Module
ok invrep_de+1Fri Oct 09windows
Detectionhightest
Disable Windows Defender AV Security Monitoring
Detects attackers attempting to disable Windows Defender using Powershell
WindowsProcess Creation
ok invrep-de+2Mon Oct 12windows