Powershell Shellcode Execution Via Callwindowproc
Detects PowerShell preparing to execute shellcode using the CallWindowProc API. This technique is used to bypass EDRs by executing code without creating a new thread, which is a commonly monitored API call.
YARA-L
