Potential PowerShell Execution Via DLL

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects potential PowerShell execution from a DLL instead of the usual PowerShell process, as seen used in PowerShdll. This detection assumes that PowerShell commands are passed via the CommandLine.