Potential Process Execution Proxy Via CL_Invocation.ps1

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process". This technique can be used to bypass application control and execute malicious code.