All Detections

posh_pc_alternate_powershell_hosts

avatar
SigmaHQ Detections@sigmaHQ
updated Oct 23, 2025018

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Sigma