Powerup Write Hijack DLL Batch File Creation
This rule detects the creation of a batch file by PowerShell, specifically looking for files ending with '.bat' when the creating process is 'powershell.exe' or 'pwsh.exe'. This behavior is indicative of the Powerup tool's 'Write Hijack DLL' functionality, which creates a self-deleting batch file (often named 'debug.bat') to execute malicious commands for DLL hijacking and privilege escalation.
Sigma
