Files
orca/src
Orca Worker f057a87eec docs(windows): qualify the no-PowerShell claim on the netstat scan
The scan starts no PowerShell of its own, but no released relay carries the
optional `windows-process-tree.node` addon (only dev-channel-win-build.yml
builds it), so the shared process-table read falls back to a CIM scan that
forks one `powershell.exe`. The EDR win is the removal of the
`-EncodedCommand` / `-ExecutionPolicy Bypass` shape, not the elimination of
PowerShell. Comment-only.
2026-09-05 18:35:53 -07:00
..