Suspicious PowerShell Module File Creation
Detects the creation of new PowerShell module files (.ps or .dll) in the first folder of the module directory structure, specifically within '\WindowsPowerShell\Modules\*\'. This pattern is considered suspicious because legitimate PowerShell modules commonly include a version folder within their directory structure, making direct creation in the module root less common for benign modules.
Sigma
