Remote Thread Creation Via PowerShell
Detects the creation of a remote thread from a PowerShell process (powershell.exe or pwsh.exe) into another process. This activity can be indicative of process injection techniques used by adversaries to execute malicious code or evade defenses. A filter is included to exclude known legitimate activity from CompatTelRunner.exe.
Sigma
