PowerShell Dropping PowerShell Script File
This rule detects when PowerShell (powershell.exe or pwsh.exe) creates a new PowerShell script file (.ps1). While this behavior can be benign in many cases, it can also indicate a dropper script attempting to establish persistence on a system. The rule filters out common legitimate scenarios such as PowerShell's internal script policy tests and temporary files created in user AppData\Local\Temp or C:\Windows\Temp directories.
Sigma
