Import PowerShell Modules From Suspicious Directories

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•16

This rule detects PowerShell scripts that attempt to import modules from suspicious directories such as the user's temporary folder ($Env:Temp), application data folder ($Env:Appdata), or the C:\Users\Public\ directory. Adversaries often use these locations to drop and execute malicious PowerShell modules to evade detection or achieve persistence.