PowerShell Script Dropped Via PowerShell.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects PowerShell creating a PowerShell file (.ps1). While often times this behavior is benign, sometimes it can be a sign of a dropper script trying to achieve persistence.