BIOC
Medium
✕
Virtual Directory configuration access via PowerShell
PowerShell was used to dump Exchange Web Service (EWS) Virtual Directories, which may indicate malicious behavior, for example, SolarStorm campaign.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007)
ATT&CK techniques: System Service Discovery (T1007)
Indicator:
Process action type = execution AND target process cmd =~ .*PSConsoleFile.*Get-WebServicesVirtualDirectory.* AND target process name = powershell.exe Host host os = windows
Preventable: yes