Suspicious Start-Process with PassThru and FilePath
This rule detects the use of `Start-Process` with the `-PassThru` and `-FilePath` parameters in PowerShell script blocks. The `-PassThru` parameter allows `Start-Process` to return a process object, which can be used to interact with the started process in the background, potentially for stealthy execution or to bypass interactive prompts. The `-FilePath` parameter specifies the executable to run. This combination can be indicative of an adversary attempting to execute a process in a less conspicuous manner.
Sigma
