description: The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field ...
What is format for finding a file with the user named Francis and with a size of 52 kilobytes in the directory /home/francis/ find /home/francis -type f -user francis -size 52k SSH as topson using his ...