Windows PowerShell Module File Created — Detection Rule
Detects the creation of a DLL within the various PowerShell module directories. This can indicate a new module being installed, attempts at ScriptBlock smuggling, or other malicious PowerShell activity utilizing modules. False positives could include installation of legitimate modules.