AgentExecutor PowerShell Execution
Detects the execution of the `AgentExecutor.exe` binary when it is used to execute PowerShell scripts. This binary can be abused as a Living Off The Land Binary (LOLBIN) to run PowerShell scripts with the ExecutionPolicy set to "Bypass" or to execute any binary named "powershell.exe" located in a path provided as the 6th positional argument. The rule specifically looks for `AgentExecutor.exe` being executed with command-line arguments indicating PowerShell script execution, such as `-powershell` or `-remediationScript`. It filters out legitimate usage where the parent process is `Microsoft.Management.Services.IntuneWindowsAgent.exe`.
Sigma
