PowerShell Copy to System Directory

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•19

This rule detects PowerShell commands that attempt to copy files into critical Windows system directories like "System32" or "SysWOW64". This activity can be indicative of persistence mechanisms, defense evasion, or credential access attempts, such as installing a malicious password filter DLL.