Potential Persistence Via PowerShell User Profile Using Add-Content

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects attempts to modify a PowerShell user profile using the `Add-Content` cmdlet to inject suspicious commands. This technique can be used for persistence, as the injected commands will execute every time a PowerShell session starts for that user.