Skip to content

Hide Navigation Hide TOC

Suspicious Runscripthelper.exe (eca49c87-8a75-4f13-9c73-a5a29e845f03)

Detects execution of powershell scripts via Runscripthelper.exe

Cluster A Galaxy A Cluster B Galaxy B Level
Suspicious Runscripthelper.exe (eca49c87-8a75-4f13-9c73-a5a29e845f03) Sigma-Rules Indirect Command Execution - T1202 (3b0e52ce-517a-4614-a523-1bd5deef6c5e) Attack Pattern 1
Suspicious Runscripthelper.exe (eca49c87-8a75-4f13-9c73-a5a29e845f03) Sigma-Rules Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 1