Hide Navigation Hide TOC

Suspicious Non PowerShell WSMAN COM Provider (df9a0e0e-fedb-4d6c-8668-d765dfc92aa7)

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Suspicious Non PowerShell WSMAN COM Provider (df9a0e0e-fedb-4d6c-8668-d765dfc92aa7)	Sigma-Rules	1
Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd)	Attack Pattern	Suspicious Non PowerShell WSMAN COM Provider (df9a0e0e-fedb-4d6c-8668-d765dfc92aa7)	Sigma-Rules	1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736)	Attack Pattern	Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830)	Attack Pattern	2
Distributed Component Object Model - T1021.003 (68a0c5ed-bee2-4513-830d-5b0d650139bd)	Attack Pattern	Remote Services - T1021 (54a649ff-439a-41a4-9856-8d144a2551ba)	Attack Pattern	2