Renamed PowerShell Under PowerShell Classic Channel
Detects a renamed PowerShell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths. The rule specifically looks for PowerShell classic logs where the 'HostName' is 'ConsoleHost' but the 'HostApplication' field does not contain typical PowerShell executable paths or names, indicating a potential renaming or masquerading attempt.
Sigma
