PowerShell Inline Execution From File
This rule detects attempts to execute PowerShell code inline from a file. It specifically looks for command-line arguments that combine PowerShell execution commands like 'iex', 'Invoke-Expression', 'Invoke-Command', or 'icm' with file reading commands such as 'cat', 'get-content', or 'type', along with the '-raw' parameter. This combination suggests that a file's content is being read and then immediately executed as PowerShell code.
Sigma
