PowerShell Executed by Cmd.exe with Non-System32 Path

nomit vyas@xoxo

•updated Apr 30, 2026•3•0•36

This rule detects instances where powershell.exe is launched by cmd.exe, and the command line does not contain 'system32'. This pattern can indicate an attempt to execute PowerShell scripts or commands from non-standard locations, potentially bypassing security controls or executing malicious code.