Randomized powershell executables - hash is poweshell.exe but file name is different.

[ravivittal]

Can someone please provide some guidance on how to go about writing a YARA-L rule for to detect this?

- Randomized powershell executables - hash is poweshell.exe but file name is different.