Initializing System...

Sigma Rule (YAML) title: Suspicious PowerShell Download id: 5f1f759e-d9d3-4d6a-91ef-c22222222222 status: test description: Detects suspicious PowerShell download commands author: Your Name date: 2024/01/01 logsource: category: process_creation product: windows detection: selection: Image|endswith: '\powershell.exe' CommandLine|contains: 'Net.WebClient' condition: selection level: high

LogPoint Query Output