StealC PowerShell Remote Thread Injection into csc.exe/chrome.exe/msedge.exe

Ibrahim Saud@tektrix

•updated 27 days ago•0•0•3

Detects instances where PowerShell.exe acts as a parent process or initiator for potentially suspicious process injections into common host processes including csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe. This activity is often associated with code execution or persistence mechanisms where PowerShell injects malicious logic into other processes.