DSInternals Suspicious PowerShell Cmdlets - ScriptBlock (via ps_script)

This rule detects execution and use of the DSInternals PowerShell module. That can be leveraged to perform what might be considered as anomalous behavior such as dumping DPAPI backup keys or manipulating NTDS.DIT files. The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.