Skip to content
Threat Feed

Tag

Scriptblocksmuggling

1 brief RSS
medium advisory

Suspicious PowerShell Module DLL Creation

The creation of a DLL file within PowerShell module directories can indicate malicious PowerShell activity, such as installing new modules or attempts at ScriptBlock smuggling, and this activity is detected using Sysmon Event ID 11.

Splunk Enterprise +2 powershell module dll filecreation scriptblocksmuggling
2r 3t