Netskope Threat Labs

INDICATOR-COMPROMISE Win.Tool.WinPWN toolkit Invoke-HandleKatz download attempt

IPS-SWG

1 SID: 61341

First seen
July 2025
Last seen
July 2025

Detects the WinPWN Windows attack toolkit, which bundles credential dumping and privilege escalation modules. Spotting these indicators early helps contain an intrusion before cyberattackers expand access.