Potential Persistence Via PowerShell User Profile Using Add-Content

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence