PowerShell AES Decryption of Embedded .NET Payload via AesCryptoServiceProvider
Detects the use of .NET AesCryptoServiceProvider in PowerShell scripts, which is frequently used by adversaries to decrypt embedded, obfuscated, or encrypted payloads within a script for malicious execution.
Sigma
