Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

Detects the creation or modification of a vscode related powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence

Detects the creation or modification of a powershell profile which could indicate suspicious activity as the profile can be used as a mean of persistence