Import PowerShell Modules From Suspicious Directories

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects PowerShell scripts attempting to import modules from suspicious directories such as temporary folders or publicly accessible user directories. This behavior can indicate an attempt to execute malicious code or evade detection by using non-standard module locations.