Potential Process Execution Proxy Via CL_Invocation.ps1

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•1

Detects calls to "SyncInvoke" that is part of the "CL_Invocation.ps1" script to proxy execution using "System.Diagnostics.Process"