InstallFix Spawns a Child from a PowerShell Script Block

Daniel Jeremiah@daniyyell

•updated Jun 20, 2026•0•0•2

Detects a hidden PowerShell stage creating a process through Start-Process, WMI, reflection, or .NET process APIs. This rule specifically looks for executable files spawned by PowerShell processes where the PowerShell command line contains keywords indicative of process creation methods like 'Start-Process', 'ProcessStartInfo', 'Win32_Process', 'CreateProcess', or 'Invoke-Expression'.