PowerShell Download to Startup Folder
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
Sigma
Detects PowerShell executing a WebClient DownloadFile method and saving the output directly into the Windows Startup folder, indicating persistence setup.
Already have an account?