Suspicious PowerShell Invocation From Script Engines
This rule detects suspicious invocations of PowerShell or PowerShell Core (pwsh.exe) when the parent process is a script engine like wscript.exe or cscript.exe. This behavior is often associated with adversaries using scripting languages to execute PowerShell commands, potentially bypassing direct PowerShell execution policies or obfuscating their activities. The rule specifically filters out legitimate activity from 'Health Service State' to reduce false positives.
Sigma
