Skip to content
Threat Feed

Actor

Azorult

1 brief RSS
high threat

Detect PowerShell AppLocker Policy Import Activity

Detection of PowerShell commands to import AppLocker policy via Import-Module Applocker and Set-AppLockerPolicy, potentially used to enforce restrictive policies or disable security products like antivirus.

Splunk Enterprise +2 Azorult applocker powershell defense-evasion endpoint
2r 1t