PowerShell Script Dropped in ProgramData

Subash Ghimire@iamsubashg

•updated Jun 12, 2026•0•0•11

This rule detects when a PowerShell script (.ps1 file) is dropped into the C:\ProgramData directory. Adversaries often use this directory to store malicious scripts or tools for persistence or execution, as it is generally writable by standard users and less monitored than other system directories.