Detects DonutLoader

Family: DonutLoader

DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

Boot or Logon Autostart Execution: Active Setup

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Command and Scripting Interpreter: PowerShell

Using powershell.exe command.