Suspicious Pester Build.bat Proxy Execution
Detects the execution of the PowerShell Pester module's Build.bat script being used as a LOLBAS proxy to execute hidden payloads, as observed in LucidRook/LucidPawn malware campaigns targeting Taiwanese organizations.
Sigma
