Remote Thread Creation Via PowerShell In Uncommon Target — Detection Rule
Detects the creation of a remote thread from a Powershell process in an uncommon target process
Detects the creation of a remote thread from a Powershell process in an uncommon target process