PowerShell Execution via PSHost Named Pipe Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

Detects the execution of PowerShell via the creation of a named pipe starting with 'PSHost'. This method can be used by adversaries to execute PowerShell commands or scripts, potentially bypassing traditional PowerShell logging mechanisms.