PowerShell Unrestricted Execution from ScreenConnect Temp Directory
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Unrestricted) originating from the ScreenConnect SystemTemp directory. This behavior is consistent with malicious campaigns, such as those deploying AsyncRAT via trojanized installers, that utilize the ScreenConnect temporary storage path to stage and execute secondary malicious payloads.
Microsoft Sentinel (KQL)
