CPU-Z Executing PowerShell

Jeremy Goldstein@jeremys1

•updated Apr 16, 2026•9•0•513

Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.