MITRE ATT&CK Technique
T1059.001
2 queries tagged with this technique.
View on MITRE ATT&CK →
-
Analytics Rules
Detect Sharepoint Toolshell Rce Encoded Command
SharePoint ToolShell RCE: encoded PowerShell arriving via SharePoint worker processes. Multi-token needles (`certutil -decode`) need `contains`, not `has_any`.
-
Hunting
Hunt Encoded Command Usage Across Fleet Time Baseline
Encoded-command executions correlated across the fleet against a rolling per-host time baseline. TimeBucket alone as the join key — deliberately no DeviceId.