Hey All, Topic really...has anyone put some work/sigs into detecting remote powershell? Figured I'd start here first...thank you. James -------------- next part -------------- An HTML attachment was scrubbed... URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20180214/f51371af/attachment.html