T1027.004

← All KQL categories

MITRE ATT&CK Technique

T1027.004

1 query tagged with this technique.
View on MITRE ATT&CK →

• Analytics Rules Detect Sharepoint Toolshell Rce Encoded Command

  SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.