PowerShell Execution via Sqlps.exe
This rule detects the execution of PowerShell code through the `sqlps.exe` utility, which is part of the Microsoft SQL Server utilities. This method can be used by adversaries to bypass detection mechanisms that rely on PowerShell script block logging, as `sqlps.exe` does not log script blocks.
Sigma
