PowerShell PInvoke Process Injection API Chain — Detection Rule
The following analytic detects PowerShell Script Block Logging (Event ID 4104) evidence of a complete P/Invoke process-injection API chain at either the compile phase or the execution phase. Portions of this search were modified to retain the same functionality while preventing antivirus products from alerting on the detection itself