PowerShell Profile Modification
Detects the creation or modification of PowerShell profile scripts (profile.ps1) in various common locations. Adversaries may modify these profiles to include arbitrary commands, functions, or modules to gain persistence or elevate privileges, as the profile script runs automatically when PowerShell starts.
Sigma
