Skip to content

Hide Navigation Hide TOC

Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 (1e0e1a81-e79b-44bc-935b-ddb9c8006b3d)

Detects the use of the Microsoft signed script "CL_mutexverifiers" to proxy the execution of additional PowerShell script commands

Cluster A Galaxy A Cluster B Galaxy B Level
System Script Proxy Execution - T1216 (f6fe9070-7a65-49ea-ae72-76292f42cebe) Attack Pattern Potential Script Proxy Execution Via CL_Mutexverifiers.ps1 (1e0e1a81-e79b-44bc-935b-ddb9c8006b3d) Sigma-Rules 1