HackTool - DInjector PowerShell Cradle Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•13

Detects the execution of the DInjector PowerShell cradle, identified by specific command-line arguments '/am51' and '/password'. This tool is often used for process injection and privilege escalation.