Jlaive In-Memory Assembly Execution via Copied PowerShell
Detects the use of Jlaive, a hack tool, to execute assemblies in a copied PowerShell instance. This technique involves using `xcopy.exe` to copy `powershell.exe` or `pwsh.exe` to a new name ending with `.bat.exe`, and then using `attrib.exe` to set system and hidden attributes on this file, likely to evade detection and execute malicious code.
Sigma
