Potential Binary Or Script Dropper Via PowerShell

SigmaHQ Detections@sigmaHQ

•updated Jul 8, 2025•0•21

Detects PowerShell creating executable files or script files. This rule specifically looks for PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files with common executable or script extensions to disk, while filtering out common temporary file locations and PowerShell module paths to reduce false positives.