Command and Scripting Interpreter: PowerShell T1059.001

Events covered

30 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 471 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (133 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Top indicator values (5097 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Exclusions (554 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 222 rules

• Alternate PowerShell Hosts - PowerShell Module
• Alternate PowerShell Hosts Pipe
• AppLocker Prevented Application or Script from Running
• AWS EC2 Startup Shell Script Change
• Bad Opsec Powershell Code Artifacts
• Base64 Encoded PowerShell Command Detected
• BloodHound Collection Files
• bXOR Operator Usage In PowerShell Command Line - PowerShell Classic
• Certificate Exported Via PowerShell
• Change PowerShell Policies to an Insecure Level
• Change PowerShell Policies to an Insecure Level - PowerShell
• ChromeLoader Malware Execution
• Cmd.EXE Missing Space Characters Execution Anomaly
• Command Line Execution with Suspicious URL and AppData Strings
• ConvertTo-SecureString Cmdlet Usage Via CommandLine
• CVE-2022-24527 Microsoft Connected Cache LPE
• Detection of PowerShell Execution via Sqlps.exe
• DSInternals Suspicious PowerShell Cmdlets
• DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
• Encoded PowerShell payload deployed (PowerShell)
• Exchange PowerShell Snap-Ins Usage
• Execute Code with Pester.bat
• Execute Code with Pester.bat as Parent
• Execution of Powershell Script in Public Folder
• Exploited CVE-2020-10189 Zoho ManageEngine
• FakeUpdates/SocGholish Activity
• Greenbug Espionage Group Indicators
• HackTool - Bloodhound/Sharphound Execution
• HackTool - Covenant PowerShell Launcher
• HackTool - CrackMapExec Execution
• HackTool - CrackMapExec Execution Patterns
• HackTool - CrackMapExec PowerShell Obfuscation
• HackTool - Default PowerSploit/Empire Scheduled Task Creation
• HackTool - Empire PowerShell Launch Parameters
• Headless Process Launched Via Conhost.EXE
• Hidden Powershell in Link File Pattern
• HTML Help HH.EXE Suspicious Child Process
• Import PowerShell Modules From Suspicious Directories
• Import PowerShell Modules From Suspicious Directories - ProcCreation
• Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace
• Invoke-Obfuscation CLIP+ Launcher
• Invoke-Obfuscation CLIP+ Launcher - PowerShell
• Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
• Invoke-Obfuscation CLIP+ Launcher - Security
• Invoke-Obfuscation CLIP+ Launcher - System
• Invoke-Obfuscation COMPRESS OBFUSCATION
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
• Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
• Invoke-Obfuscation COMPRESS OBFUSCATION - Security
• Invoke-Obfuscation COMPRESS OBFUSCATION - System
• Invoke-Obfuscation Obfuscated IEX Invocation
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
• Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
• Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
• Invoke-Obfuscation RUNDLL LAUNCHER - Security
• Invoke-Obfuscation RUNDLL LAUNCHER - System
• Invoke-Obfuscation STDIN+ Launcher
• Invoke-Obfuscation STDIN+ Launcher - Powershell
• Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
• Invoke-Obfuscation STDIN+ Launcher - Security
• Invoke-Obfuscation STDIN+ Launcher - System
• Invoke-Obfuscation VAR+ Launcher
• Invoke-Obfuscation VAR+ Launcher - PowerShell
• Invoke-Obfuscation VAR+ Launcher - PowerShell Module
• Invoke-Obfuscation VAR+ Launcher - Security
• Invoke-Obfuscation VAR+ Launcher - System
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
• Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
• Invoke-Obfuscation Via Stdin
• Invoke-Obfuscation Via Stdin - Powershell
• Invoke-Obfuscation Via Stdin - PowerShell Module
• Invoke-Obfuscation Via Stdin - Security
• Invoke-Obfuscation Via Stdin - System
• Invoke-Obfuscation Via Use Clip
• Invoke-Obfuscation Via Use Clip - Powershell
• Invoke-Obfuscation Via Use Clip - PowerShell Module
• Invoke-Obfuscation Via Use Clip - Security
• Invoke-Obfuscation Via Use Clip - System
• Invoke-Obfuscation Via Use MSHTA
• Invoke-Obfuscation Via Use MSHTA - PowerShell
• Invoke-Obfuscation Via Use MSHTA - PowerShell Module
• Invoke-Obfuscation Via Use MSHTA - Security
• Invoke-Obfuscation Via Use MSHTA - System
• Invoke-Obfuscation Via Use Rundll32 - PowerShell
• Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
• Invoke-Obfuscation Via Use Rundll32 - Security
• Invoke-Obfuscation Via Use Rundll32 - System
• Kalambur Backdoor Curl TOR SOCKS Proxy Execution
• Lace Tempest PowerShell Evidence Eraser
• Lace Tempest PowerShell Launcher
• Malicious Base64 Encoded PowerShell Keywords in Command Lines
• Malicious Nishang PowerShell Commandlets
• Malicious PowerShell Commandlets - PoshModule
• Malicious PowerShell Commandlets - ProcessCreation
• Malicious PowerShell Commandlets - ScriptBlock
• Malicious PowerShell Keywords
• Malicious PowerShell Scripts - FileCreation
• Malicious PowerShell Scripts - PoshModule
• Malicious ShellIntel PowerShell Commandlets
• MERCURY APT Activity
• Net WebClient Casing Anomalies
• Netcat The Powershell Version
• Network Connection Initiated By PowerShell Process
• New PowerShell Instance Created
• Non Interactive PowerShell Process Spawned
• Nslookup PowerShell Download Cradle
• NTFS Alternate Data Stream
• Obfuscated PowerShell MSI Install via WindowsInstaller COM
• Obfuscated PowerShell OneLiner Execution
• Operation Wocao Activity
• Operation Wocao Activity - Security
• Payload downloaded via PowerShell
• PipeShell exfiltration over named pipes
• Potential APT FIN7 Exploitation Activity
• Potential APT FIN7 POWERHOLD Execution
• Potential Baby Shark Malware Activity
• Potential BlackByte Ransomware Activity
• Potential Bumblebee Remote Thread Creation
• Potential Data Exfiltration Activity Via CommandLine Tools
• Potential DLL File Download Via PowerShell Invoke-WebRequest
• Potential Emotet Activity
• Potential Encoded PowerShell Patterns In CommandLine
• Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)
• Potential Exploitation of GoAnywhere MFT Vulnerability
• Potential Persistence Via Powershell Search Order Hijacking - Task
• Potential PowerShell Command Line Obfuscation
• Potential PowerShell Downgrade Attack
• Potential PowerShell Obfuscation Using Alias Cmdlets
• Potential PowerShell Obfuscation Using Character Join
• Potential PowerShell Obfuscation Via Reversed Commands
• Potential PowerShell Obfuscation Via WCHAR/CHAR
• Potential Powershell ReverseShell Connection
• Potential POWERTRASH Script Execution
• Potential Remote PowerShell Session Initiated
• Potential Suspicious PowerShell Keywords
• Potential WinAPI Calls Via PowerShell Scripts
• Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
• Potentially Suspicious Command Executed Via Run Dialog Box - Registry
• Potentially Suspicious PowerShell Child Processes
• Potentially Suspicious Powershell Script Execution From Temp Folder
• Potentially Suspicious WebDAV LNK Execution
• PowerShell ADRecon Execution
• PowerShell Base64 Encoded FromBase64String Cmdlet
• PowerShell Base64 Encoded IEX Cmdlet
• PowerShell Base64 Encoded Invoke Keyword
• PowerShell Base64 Encoded Reflective Assembly Load
• PowerShell Base64 Encoded WMI Classes
• PowerShell Called from an Executable Version Mismatch
• PowerShell Core DLL Loaded By Non PowerShell Process
• PowerShell Create Local User
• PowerShell Credential Prompt
• PowerShell Downgrade Attack - PowerShell
• PowerShell Download Pattern
• PowerShell Download Via Net.WebClient - PowerShell Classic
• Powershell Executed From Headless ConHost Process
• Powershell Inline Execution From A File
• PowerShell MSI Install via WindowsInstaller COM From Remote Location
• Powershell MsXml COM Object
• PowerShell PSAttack
• PowerShell Remote Session Creation
• PowerShell Script Run in AppData
• PowerShell ShellCode
• PowerShell Web Access Installation - PsScript
• Powershell XML Execute Command
• PowerView PowerShell Cmdlets - ScriptBlock
• PSAsyncShell - Asynchronous TCP Reverse Shell
• Raspberry Robin Initial Execution From External Drive
• Raspberry Robin Subsequent Execution of Commands
• Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace
• Remote LSASS Process Access Through Windows Remote Management
• Remote PowerShell Session (PS Classic)
• Remote PowerShell Session (PS Module)
• Remote PowerShell Session Host Process (WinRM)
• Remote PowerShell Sessions Network Connections (WinRM)
• Remote Thread Creation Via PowerShell
• Remote Thread Creation Via PowerShell In Uncommon Target
• Renamed Powershell Under Powershell Channel
• Rorschach Ransomware Execution Activity
• Scheduled Task Executing Encoded Payload from Registry
• Scheduled Task Executing Payload from Registry
• Silence.EDA Detection
• SQL Client Tools PowerShell Session Detection
• Suspicious CrushFTP Child Process
• Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
• Suspicious Encoded PowerShell Command Line
• Suspicious Execution of Powershell with Base64
• Suspicious File Execution From Internet Hosted WebDav Share
• Suspicious HH.EXE Execution
• Suspicious Interactive PowerShell as SYSTEM
• Suspicious PowerShell Download - PoshModule
• Suspicious PowerShell Download - Powershell Script
• Suspicious PowerShell Download and Execute Pattern
• Suspicious PowerShell Encoded Command Patterns
• Suspicious PowerShell IEX Execution Patterns
• Suspicious PowerShell Invocation From Script Engines
• Suspicious PowerShell Invocations - Generic
• Suspicious PowerShell Invocations - Generic - PowerShell Module
• Suspicious PowerShell Invocations - Specific
• Suspicious PowerShell Invocations - Specific - PowerShell Module
• Suspicious PowerShell Parameter Substring
• Suspicious PowerShell Parent Process
• Suspicious PrinterPorts Creation (CVE-2020-1048)
• Suspicious Schtasks Execution AppData Folder
• Suspicious WSMAN Provider Image Loads
• Suspicious XOR Encoded PowerShell Command
• TropicTrooper Campaign November 2018
• Turla Group Commands May 2020
• UNC2452 PowerShell Pattern
• UNC2452 Process Creation Patterns
• Uncommon PowerShell Hosts
• Unusually Long PowerShell CommandLine
• Usage Of Web Request Commands And Cmdlets
• Usage Of Web Request Commands And Cmdlets - ScriptBlock
• Vice Society directory crawling script for data exfiltration (via ps_script)
• WinAPI Function Calls Via PowerShell Scripts
• WinAPI Library Calls Via PowerShell Scripts
• Windows Shell/Scripting Processes Spawning Suspicious Programs
• WMImplant Hack Tool

Elastic 112 rules

• AWS SSM `SendCommand` with Run Shell Command Parameters
• AWS SSM Session Manager Child Process Execution
• Azure Run Command Correlated with Process Execution
• Azure Run Command Script Child Process
• Clearing Windows Console History
• Command and Scripting Interpreter via Windows Scripts
• Command Execution via SolarWinds Process
• Command Line Obfuscation via Whitespace Padding
• Command Shell Activity Started via RunDLL32
• Delayed Execution via Ping
• Deprecated - Microsoft Exchange Transport Agent Install Script
• Deprecated - Potential PowerShell Obfuscated Script
• Deprecated - PowerShell Script with Discovery Capabilities
• Deprecated - PowerShell Script with Remote Execution Capabilities via WinRM
• Disabling Windows Defender Security Settings via PowerShell
• Dynamic IEX Reconstruction via Method String Access
• Entra ID PowerShell Sign-in
• Execution from Unusual Directory - Command Line
• Execution of a Downloaded Windows Script
• Execution of Persistent Suspicious Program
• Execution via GitHub Actions Runner
• Execution via OpenClaw Agent
• Execution with Explicit Credentials via Scripting
• Exporting Exchange Mailbox via PowerShell
• Incoming Execution via PowerShell Remoting
• Long Base64 Encoded Command via Scripting Interpreter
• M365 Security Compliance Admin Signal
• M365 SharePoint/OneDrive File Access via PowerShell
• Microsoft Build Engine Started an Unusual Process
• Microsoft Build Engine Started by a Script Process
• Microsoft Exchange Worker Spawning Suspicious Processes
• New ActiveSyncAllowedDeviceID Added via PowerShell
• Outbound Scheduled Task Activity via PowerShell
• Potential Antimalware Scan Interface Bypass via PowerShell
• Potential Command Shell via NetCat
• Potential Dynamic IEX Reconstruction via Environment Variables
• Potential Execution via FileFix Phishing Attack
• Potential Fake CAPTCHA Phishing Attack
• Potential Malicious PowerShell Based on Alert Correlation
• Potential PowerShell HackTool Script by Author
• Potential PowerShell HackTool Script by Function Names
• Potential PowerShell Obfuscated Script via High Entropy
• Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
• Potential PowerShell Obfuscation via Character Array Reconstruction
• Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
• Potential PowerShell Obfuscation via High Numeric Character Proportion
• Potential PowerShell Obfuscation via High Special Character Proportion
• Potential PowerShell Obfuscation via Invalid Escape Sequences
• Potential PowerShell Obfuscation via Reverse Keywords
• Potential PowerShell Obfuscation via Special Character Overuse
• Potential PowerShell Obfuscation via String Concatenation
• Potential PowerShell Obfuscation via String Reordering
• Potential PowerShell Pass-the-Hash/Relay Script
• Potential Process Injection via PowerShell
• Potential SAP NetWeaver Exploitation
• Potential SharpRDP Behavior
• Potential Veeam Credential Access Command
• PowerShell Invoke-NinjaCopy script
• PowerShell Kerberos Ticket Dump
• PowerShell Kerberos Ticket Request
• PowerShell Keylogging Script
• PowerShell Mailbox Collection Script
• PowerShell MiniDump Script
• PowerShell Obfuscation via Negative Index String Reversal
• PowerShell PSReflect Script
• PowerShell Script with Archive Compression Capabilities
• PowerShell Script with Log Clear Capabilities
• PowerShell Script with Password Policy Discovery Capabilities
• PowerShell Script with Token Impersonation Capabilities
• PowerShell Script with Veeam Credential Access Capabilities
• PowerShell Script with Webcam Video Capture Capabilities
• PowerShell Script with Windows Defender Tampering Capabilities
• PowerShell Share Enumeration Script
• PowerShell Suspicious Discovery Related Windows API Functions
• PowerShell Suspicious Payload Encoded and Compressed
• PowerShell Suspicious Script with Audio Capture Capabilities
• PowerShell Suspicious Script with Clipboard Retrieval Capabilities
• PowerShell Suspicious Script with Screenshot Capabilities
• Process Activity via Compiled HTML File
• Proxy Execution via Console Window Host
• Rare Powershell Script
• Remote File Download via PowerShell
• Scheduled Task Created by a Windows Script
• ScreenConnect Server Spawning Suspicious Processes
• Service Control Spawned via Script Interpreter
• Suspicious .NET Reflection via PowerShell
• Suspicious Browser Child Process
• Suspicious Emond Child Process
• Suspicious Execution from a Mounted Device
• Suspicious Execution from VS Code Extension
• Suspicious Explorer Child Process
• Suspicious JetBrains TeamCity Child Process
• Suspicious Microsoft HTML Application Child Process
• Suspicious MS Office Child Process
• Suspicious MS Outlook Child Process
• Suspicious Portable Executable Encoded in Powershell Script
• Suspicious PowerShell Engine ImageLoad
• Suspicious Powershell Script
• Suspicious React Server Child Process
• Suspicious ScreenConnect Client Child Process
• Suspicious Shell Execution via Velociraptor
• Suspicious SolarWinds Web Help Desk Java Module Load or Child Process
• Suspicious Windows Powershell Arguments
• Suspicious Zoom Child Process
• System Shells via Services
• Veeam Backup Library Loaded by Unusual Process
• Volume Shadow Copy Deletion via PowerShell
• Web Shell Detection: Script Process Child of Common Web Processes
• Windows Defender Exclusions Added via PowerShell
• Windows Firewall Disabled via PowerShell
• Windows Script Executing PowerShell
• Windows Server Update Service Spawning Suspicious Processes

Splunk 125 rules

• Bypass or Unrestricted PowerShell Execution (PowerShell)
• Cisco Secure Firewall - Communication Over Suspicious Ports
• Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity
• Command-Line Interface Execution (PowerShell)
• Command-Line Interface Execution (Sysmon)
• Command-Line Interface Execution (Windows Event Log)
• Common Exchange Recon cmdlets (PowerShell)
• CrushFTP Authentication Bypass Exploitation
• Detect Certify With PowerShell Script Block Logging
• Detect Empire with PowerShell Script Block Logging
• Detect Mimikatz With PowerShell Script Block Logging
• Encoded Powershell Command (PowerShell)
• Encoded Powershell Command (Sysmon)
• Encoded Powershell Command (Windows Event Log)
• Exchange PowerShell Module Usage
• Get-ForestTrust with PowerShell Script Block
• GetLocalUser with PowerShell Script Block
• GetWmiObject User Account with PowerShell Script Block
• High Entropy Powershell (PowerShell)
• Impacket_Empire's WMIExec (Windows Event Log)
• Invoke-Expression Command (PowerShell)
• Invoke-Expression Command (Sysmon)
• Invoke-Expression Command (Windows Event Log)
• Invoke-WebRequest Command (PowerShell)
• Invoke-WebRequest Command (Sysmon)
• Invoke-WebRequest Command (Windows Event Log)
• Malicious PowerShell Process - Execution Policy Bypass
• Malicious PowerShell Process With Obfuscation Techniques
• Meterpreter Reverse Shell (Windows Event Log)
• Microsoft Build Engine Suspicious Parent Process (Sysmon)
• Microsoft Build Engine Suspicious Parent Process (Windows Event Log)
• Modify Exchange Access Settings (PowerShell)
• Nishang PowershellTCPOneLine
• Possible Lateral Movement PowerShell Spawn
• Potential PowerShell Post-Exploitation Activity (Sysmon)
• Potential PowerShell Post-Exploitation Activity (Windows Event Log)
• Potential Proxy Malware via AutoRun Key (PowerShell)
• Potential Proxy Malware via AutoRun Key (Sysmon)
• Potential Proxy Malware via AutoRun Key (Windows Event Log)
• PowerShell - Connect To Internet With Hidden Window
• PowerShell 4104 Hunting
• PowerShell Clipboard Access (PowerShell)
• Powershell COM Hijacking InprocServer32 Modification
• PowerShell CreateDecryptor (PowerShell)
• PowerShell CreateDecryptor (Sysmon)
• PowerShell CreateDecryptor (Windows Event Log)
• Powershell Creating Thread Mutex
• PowerShell Domain Enumeration
• PowerShell Downgrade (PowerShell)
• PowerShell Downgrade (Sysmon)
• PowerShell Downgrade (Windows Event Log)
• PowerShell Download Activity (PowerShell)
• PowerShell DownloadFile_DownloadString (PowerShell)
• PowerShell DownloadFile_DownloadString (Sysmon)
• PowerShell DownloadFile_DownloadString (Windows Event Log)
• PowerShell Enable PowerShell Remoting
• PowerShell Environment Variable Execution
• Powershell Execute COM Object
• Powershell Fileless Process Injection via GetProcAddress
• Powershell Fileless Script Contains Base64 Encoded Content
• Powershell ICMP Data Exfiltration (PowerShell)
• Powershell Load Module in Meterpreter
• PowerShell Loading DotNET into Memory via Reflection
• PowerShell Modifying Registry Values (PowerShell)
• PowerShell Modifying Registry Values (Sysmon)
• PowerShell Modifying Registry Values (Windows Event Log)
• PowerShell PInvoke Process Injection API Chain
• Powershell Processing Stream Of Data
• PowerShell Script Block With URL Chain
• PowerShell Start or Stop Service
• Powershell Using memory As Backing Store
• PowerShell WebRequest Using Memory Stream
• PowerShell XML Retrieval (PowerShell)
• PowerShell XML Retrieval (Sysmon)
• PowerShell XML Retrieval (Windows Event Log)
• PowerView_SharpView Commands (PowerShell)
• Recon Using WMI Class
• Set Default PowerShell Execution Policy To Unrestricted or Bypass
• Suspicious Executable by Powershell (EDR)
• Suspicious Executable by Powershell (Sysmon)
• Suspicious Executable by Powershell (Windows Event Log)
• Suspicious Powershell (PowerShell)
• Suspicious PowerShell Clipboard Activity (PowerShell)
• Suspicious PowerShell Clipboard Activity (Sysmon)
• Suspicious PowerShell Clipboard Activity (Windows Event Log)
• Suspicious PowerShell Parameter Substring (PowerShell)
• Suspicious PowerShell Parameter Substring (Sysmon)
• Suspicious PowerShell Parameter Substring (Windows Event Log)
• Unloading AMSI via Reflection
• WebDAV LNK Execution (Sysmon)
• WebDAV LNK Execution (Windows Event Log)
• WebLogic CVE-2017-10271 (PowerShell)
• WebLogic CVE-2017-10271 (Sysmon)
• WebLogic CVE-2017-10271 (Windows Event Log)
• Windows Account Access Removal via Logoff Exec
• Windows Cobalt Strike PowerShell Loader
• Windows Crowdstrike RTR Script Execution
• Windows Default Cobalt Strike PowerShell Beacon
• Windows Enable PowerShell Web Access
• Windows Explorer LNK Exploit Process Launch With Padding
• Windows Explorer.exe Spawning PowerShell or Cmd
• Windows File Download Via PowerShell
• Windows MSExchange Management Mailbox Cmdlet Usage
• Windows Powershell Cryptography Namespace
• Windows PowerShell FakeCAPTCHA Clipboard Execution
• Windows PowerShell Get CIMInstance Remote Computer
• Windows Powershell Import Applocker Policy
• Windows PowerShell Invoke-RestMethod IP Information Collection
• Windows PowerShell Invoke-Sqlcmd Execution
• Windows Powershell Logoff User via Quser
• Windows PowerShell Module File Created
• Windows PowerShell MSIX Package Installation
• Windows PowerShell Process Implementing Manual Base64 Decoder
• Windows PowerShell Process With Malicious String
• Windows Powershell RemoteSigned File
• Windows PowerShell ScheduleTask
• Windows PowerShell Script Block With Malicious String
• Windows PowerShell Script From WindowsApps Directory
• Windows PowerShell Script TabExpansion Direct Call
• Windows PowerShell WMI Win32 ScheduledJob
• Windows PowGoop Beacon Decoding
• Windows Shell Process from CrushFTP
• Windows Software Discovery Via PowerShell
• Windows SSH Proxy Command
• Windows Suspicious React or Next.js Child Process

Kusto 7 rules

• A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema)
• Azure VM Run Command operations executing a unique PowerShell script
• Cisco Cloud Security - Windows PowerShell User-Agent Detected
• Exchange Worker Process Making Remote Call
• Execution attempts stateful anomaly on database
• Powershell Empire Cmdlets Executed in Command Line
• PowerShell without powershell.exe

YARA-L 5 rules

• Base64 Encoded PowerShell Command Detected
• ConvertTo-SecureString Cmdlet Usage Via CommandLine
• PowerShell DownloadFile
• PowerShell Web Download
• W3WP Launching Encoded Powershell