PowerShell Module File Created By Non-PowerShell Process

SigmaHQ Detections@sigmaHQ

•updated Oct 9, 2025•0•22

Detects the creation of PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories by processes that are not recognized as legitimate PowerShell executables or installers. This can indicate an attempt to establish persistence or execute malicious code by injecting or creating malicious PowerShell modules.