T1055 — Process Injection - PowerShell Injection Into Remote Process
This detection catches activity of PowerShell injecting into a remote process. In the source article and ClickFix attack chain analysis, the targeted processes observed were svchost.exe and explorer.exe. However upon testing, a baseline was established to show that PowerShell should not be observed injecting into any other process besides itself via the ActionType of CreateRemoteThreadApiCall.
Microsoft Sentinel (KQL)
