PowerShell terminating mshta/wscript/addInProcess or .NET framework processes

Ibrahim Saud@tektrix

•updated Sep 21, 2026•0•0•3

Detects suspicious PowerShell command lines indicative of process termination or abnormal enumeration of .NET Framework process directories via WMI. This includes using Stop-Process against specific proxy execution binaries or using Get-CimInstance to inspect sensitive .NET framework directory structures, which may be associated with process hollowing or security product interference.