UtilityFunctions.ps1 Proxy DLL Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects the use of a Microsoft signed script, UtilityFunctions.ps1, executing a managed DLL with PowerShell. This technique can be used by adversaries to bypass application control and signature validation.