Browser LabLD-SIGMA-LAB-001Medium
Browser LabLD-SIGMA-LAB-001Medium15 min
Build a Process Detection
A confirmed intrusion spawned encoded PowerShell from a Word document. Choose the selection that catches this behaviour durably — not the attacker's specific hash or IP.
What you will be able to do
- Choose durable behavioural fields over volatile artifacts.
- Pick the right value modifiers.
Detection EngineeringLog AnalysisT1059.001 — PowerShell
Sign in to start this lab.
Sign in