AgentExecutor PowerShell Execution

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects execution of the AgentExecutor.exe binary. Which can be abused as a LOLBIN to execute powershell scripts with the ExecutionPolicy "Bypass" or any binary named "powershell.exe" located in the path provided by 6th positional argument