Windows AgentExecutor (LOLBAS) Abuse

Danny Y@zendannyy

•updated Jun 13, 2026•2•0•6

Detects abuse of legitimate Windows binary AgentExecutor.exe, executing powershell scripts. Correlation rule