Skip to content

Update the detection logic of Suspicious Start-Process PassThru and added the alias saps#6021

Open
eriknordstrm wants to merge 1 commit into
SigmaHQ:masterfrom
eriknordstrm:fix-posh-ps-susp-start-process
Open

Update the detection logic of Suspicious Start-Process PassThru and added the alias saps#6021
eriknordstrm wants to merge 1 commit into
SigmaHQ:masterfrom
eriknordstrm:fix-posh-ps-susp-start-process

Updated the detection logic and added the alias saps

9282f56
Select commit
Loading
Failed to load commit list.
Sign in for the full log view
Greet First-Time Contributors
succeeded May 18, 2026 in 3s