Badlisted process makes network request

Network request originating from process or tool commonly abused by malware.

Command and Scripting Interpreter: PowerShell

Start PowerShell.

Downloads MZ/PE file

Drops file in Drivers directory

Manipulates Digital Signatures

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.