Suspicious Interactive PowerShell as SYSTEM

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context