Suspicious Unblock-File Usage
This rule detects the use of the PowerShell cmdlet 'Unblock-File' with the '-Path' parameter. This cmdlet is used to remove the Zone.Identifier alternate data stream from a file, which marks it as downloaded from the internet. Adversaries may use this to bypass security warnings and execution restrictions associated with files downloaded from untrusted sources, often as part of a defense evasion strategy.
Sigma
