Potential FIN7 POWERHOLD PowerShell Execution
Detects the execution of a PowerShell script known as POWERHOLD, which has been attributed to the FIN7 threat group. The rule specifically looks for the presence of '$env:APPDATA', 'function MainPayload', '::WriteAllBytes', and 'wscript.exe' within the PowerShell script block text, indicating the execution of this specific malicious script.
Sigma
