Suspicious Runscripthelper.exe Execution with PowerShell
Detects the execution of PowerShell scripts via 'Runscripthelper.exe' when the command line contains 'surfacecheck'. This behavior is suspicious as 'Runscripthelper.exe' is a legitimate Windows binary that can be abused for indirect command execution, often as part of Living Off The Land Binaries and Scripts (LOLBAS) techniques.
Sigma
