Suspicious Process Loading PowerShell Engine

X__Junior

Detects suspicious processes loading the PowerShell engine, which may indicate the execution of PowerShell commands outside of powershell.exe. Adversaries often abuse this technique for stealthy execution of malicious scripts, defense evasion. Common benign applications rarely load this DLL, making it a useful indicator of suspicious activity.

2025-02-27 00:00:00

None

9e8676a0-20d9-4c8a-bc99-d3d77436c218

attack.defense-evasion

Nextron Sigma feed only (private)