Malicious PowerShell Script File Creation

SigmaHQ Detections@sigmaHQ

•updated Jul 7, 2025•1•0•43

Detects the creation of known offensive PowerShell scripts used for exploitation, reconnaissance, credential access, persistence, and other malicious activities. The rule identifies specific filenames associated with popular PowerShell offensive security frameworks and tools.