Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1059.001

PowerShell

Execution 408 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
elastic Suspicious Command Execution from Visual Studio Code production 2026-10-26
elastic Web Shell Detection: Script Process Child of Common Web Processes production 2026-10-23
elastic AWS SSM Session Manager Child Process Execution production 2026-10-21
sigma AppLocker Application Would Have Been Blocked experimental 2026-10-20
elastic Suspicious Windows Powershell Arguments production 2026-10-19
sigma Alternate PowerShell Hosts - PowerShell Module test 2026-10-19
elastic Potential PowerShell Obfuscated Script via High Entropy production 2026-10-19
splunk PowerShell Download from Code Hosting Service production 2026-10-13
splunk Windows Suspicious React or Next.js Child Process production 2026-10-09
elastic Suspicious Microsoft HTML Application Child Process production 2026-10-09
splunk Possible Lateral Movement PowerShell Spawn production 2026-10-09
elastic Proxy Execution via Console Window Host production 2026-10-09
elastic Suspicious React Server Child Process production 2026-10-09
elastic Potential Prompt Injection Coercing Shell Execution production 2026-10-09
splunk PowerShell Enable PowerShell Remoting production 2026-10-09
splunk Windows SSH Proxy Command production 2026-10-09
splunk Windows PowerShell Get CIMInstance Remote Computer production 2026-10-09
elastic Suspicious SolarWinds Web Help Desk Java Module Load or Child Process production 2026-10-09
splunk PowerShell Start or Stop Service production 2026-10-09
splunk Cisco Secure Firewall - Communication Over Suspicious Ports production 2026-10-08
sigma PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script experimental 2026-10-06
elastic Command Execution via SolarWinds Process production 2026-10-06
elastic Incoming Execution via PowerShell Remoting production 2026-10-06
elastic Long Base64 Encoded Command via Scripting Interpreter production 2026-10-06
sigma PowerShell Dynamic Module Invocation Via ExportedCommands Array Index experimental 2026-10-06
elastic Potential FileFix Command via Windows Explorer Address Bar production 2026-10-05
elastic Potential ClickFix Command via Windows Run Dialog production 2026-10-05
elastic PowerShell Obfuscation via Negative Index String Reversal production 2026-10-05
splunk Powershell Execute COM Object production 2026-10-02
splunk Windows PowerShell ScheduleTask production 2026-10-02
splunk Windows File Download Via PowerShell production 2026-10-02
splunk Powershell COM Hijacking InprocServer32 Modification production 2026-10-02
elastic Potential Execution via FileFix Phishing Attack production 2026-09-28
splunk Windows Crowdstrike RTR Script Execution production 2026-09-28
elastic Potential TerminalFix Cloudflare Lure in PowerShell production 2026-09-28
elastic Execution via OpenClaw Agent production 2026-09-25
elastic Suspicious PowerShell from npm Package Install production 2026-09-22
splunk Windows PowerShell Script Block With Malicious String production 2026-09-22
splunk Windows PowerShell Process With Malicious String production 2026-09-22
elastic PowerShell Script with Token Impersonation Capabilities production 2026-09-18
elastic Suspicious MS Outlook Child Process production 2026-09-18
elastic Suspicious MS Office Child Process production 2026-09-18
elastic Microsoft Exchange Worker Spawning Suspicious Processes production 2026-09-18
elastic Suspicious Execution from VS Code Extension production 2026-09-18
elastic Windows Script Executing PowerShell production 2026-09-18
elastic Suspicious Child Process of PaperCut Server Component production 2026-09-18
elastic Suspicious JetBrains TeamCity Child Process production 2026-09-18
elastic Volume Shadow Copy Deletion via PowerShell production 2026-09-18
elastic Execution of a Downloaded Windows Script production 2026-09-18
elastic Potential Fake CAPTCHA Phishing Attack production 2026-09-18
elastic Process Activity via Compiled HTML File production 2026-09-18
elastic Suspicious PowerShell Engine ImageLoad production 2026-09-18
elastic Outbound Scheduled Task Activity via PowerShell production 2026-09-18
elastic Potential Command Shell via NetCat production 2026-09-18
elastic Command and Scripting Interpreter via Windows Scripts production 2026-09-18
elastic PowerShell PSReflect Script production 2026-09-18
elastic Suspicious Portable Executable Encoded in Powershell Script production 2026-09-18
elastic Potential Malicious PowerShell Based on Alert Correlation production 2026-09-18
elastic Potential PowerShell HackTool Script by Function Names production 2026-09-18
elastic Potential PowerShell HackTool Script by Author production 2026-09-18
elastic Execution from Unusual Directory - Command Line production 2026-09-18
elastic Delayed Execution via Ping production 2026-09-18
elastic Command Shell Activity Started via RunDLL32 production 2026-09-18
elastic Suspicious Child Process via Azure VM CustomScript Extension production 2026-09-18
elastic PowerShell Suspicious Discovery Related Windows API Functions production 2026-09-18
elastic PowerShell Share Enumeration Script production 2026-09-18
elastic Suspicious Zoom Child Process production 2026-09-18
elastic Suspicious Execution from a Mounted Device production 2026-09-18
elastic Windows Firewall Disabled via PowerShell production 2026-09-18
elastic Potential Process Injection via PowerShell production 2026-09-18
elastic Potential PowerShell Obfuscation via Special Character Overuse production 2026-09-18
elastic Potential PowerShell Obfuscation via String Reordering production 2026-09-18
elastic Potential PowerShell Obfuscation via String Concatenation production 2026-09-18
elastic Potential PowerShell Obfuscation via Reverse Keywords production 2026-09-18
elastic Dynamic IEX Reconstruction via Method String Access production 2026-09-18
elastic Potential Dynamic IEX Reconstruction via Environment Variables production 2026-09-18
elastic Potential PowerShell Obfuscation via High Numeric Character Proportion production 2026-09-18
elastic Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation production 2026-09-18
elastic Potential PowerShell Obfuscation via Character Array Reconstruction production 2026-09-18
elastic Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion production 2026-09-18
elastic Potential PowerShell Obfuscation via Invalid Escape Sequences production 2026-09-18
elastic PowerShell Script with Windows Defender Tampering Capabilities production 2026-09-18
elastic PowerShell Suspicious Payload Encoded and Compressed production 2026-09-18
elastic Suspicious .NET Reflection via PowerShell production 2026-09-18
elastic Microsoft Build Engine Started an Unusual Process production 2026-09-18
elastic Microsoft Build Engine Started by a Script Process production 2026-09-18
elastic Disabling Windows Defender Security Settings via PowerShell production 2026-09-18
elastic Windows Defender Exclusions Added via PowerShell production 2026-09-18
elastic Clearing Windows Console History production 2026-09-18
elastic Potential AMSI Bypass via RPC Runtime Hooking production 2026-09-18
elastic Potential Antimalware Scan Interface Bypass via PowerShell production 2026-09-18
elastic Potential Veeam Credential Access Command production 2026-09-18
elastic Veeam Backup Library Loaded by Unusual Process production 2026-09-18
elastic PowerShell Script with Veeam Credential Access Capabilities production 2026-09-18
elastic PowerShell Kerberos Ticket Request production 2026-09-18
elastic Potential PowerShell Pass-the-Hash/Relay Script production 2026-09-18
elastic PowerShell MiniDump Script production 2026-09-18
elastic PowerShell Kerberos Ticket Dump production 2026-09-18
elastic PowerShell Invoke-NinjaCopy script production 2026-09-18
elastic Suspicious Shell Execution via Velociraptor production 2026-09-18
elastic Suspicious ScreenConnect Client Child Process production 2026-09-18
elastic Remote File Download via PowerShell production 2026-09-18
elastic PowerShell Script with Webcam Video Capture Capabilities production 2026-09-18
elastic PowerShell Suspicious Script with Screenshot Capabilities production 2026-09-18
elastic PowerShell Mailbox Collection Script production 2026-09-18
elastic PowerShell Keylogging Script production 2026-09-18
elastic PowerShell Suspicious Script with Clipboard Retrieval Capabilities production 2026-09-18
elastic PowerShell Suspicious Script with Audio Capture Capabilities production 2026-09-18
elastic Exporting Exchange Mailbox via PowerShell production 2026-09-18
elastic Rare Powershell Script production 2026-09-18
elastic Suspicious Powershell Script production 2026-09-18
elastic Execution with Explicit Credentials via Scripting production 2026-09-18
elastic Suspicious Emond Child Process production 2026-09-18
elastic Suspicious Browser Child Process production 2026-09-18
elastic M365 SharePoint/OneDrive File Access via PowerShell production 2026-09-18
elastic Entra ID PowerShell Sign-in production 2026-09-18
elastic Execution via GitHub Actions Runner production 2026-09-18
elastic Potential SAP NetWeaver Exploitation production 2026-09-18
elastic Azure Run Command Correlated with Process Execution production 2026-09-18
elastic Azure Run Command Script Child Process production 2026-09-18
elastic AWS SSM `SendCommand` with Run Shell Command Parameters production 2026-09-18
elastic Command Line Obfuscation via Whitespace Padding production 2026-09-18
elastic Service Control Spawned via Script Interpreter production 2026-09-18
elastic System Shells via Services production 2026-09-18
elastic Execution of Persistent Suspicious Program production 2026-09-18
elastic New ActiveSyncAllowedDeviceID Added via PowerShell production 2026-09-18
elastic Scheduled Task Created by a Windows Script production 2026-09-18
elastic Potential SharpRDP Behavior production 2026-09-18
elastic ScreenConnect Server Spawning Suspicious Processes production 2026-09-18
elastic Suspicious Explorer Child Process production 2026-09-18
elastic Windows Server Update Service Spawning Suspicious Processes production 2026-09-18
sigma Potential PowerShell Obfuscation Using Alias Cmdlets test 2026-09-17
splunk CrushFTP Authentication Bypass Exploitation production 2026-09-08
splunk Windows Content Copied from Browser was Executed production 2026-09-07
splunk PowerShell 4104 Hunting production 2026-09-03
elastic Deprecated - Potential PowerShell Obfuscated Script deprecated 2026-08-19
splunk Windows Powershell Commands from DNS TXT production 2026-07-30
sigma Suspicious WSMAN Provider Image Loads test 2026-07-28
sigma PowerShell Core DLL Loaded By Non PowerShell Process test 2026-07-28
splunk Malicious PowerShell Process - Execution Policy Bypass production 2026-07-20
splunk Set Default PowerShell Execution Policy To Unrestricted or Bypass production 2026-07-20
splunk Windows PowerShell FakeCAPTCHA Clipboard Execution production 2026-07-14
splunk PowerShell Loading DotNET into Memory via Reflection production 2026-06-29
splunk PowerShell Environment Variable Execution production 2026-06-29
splunk Windows Powershell Import Applocker Policy production 2026-06-29
splunk Windows Powershell Logoff User via Quser production 2026-06-29
splunk Powershell Processing Stream Of Data production 2026-06-29
splunk PowerShell Domain Enumeration production 2026-06-28
splunk Windows Powershell Cryptography Namespace production 2026-06-25
splunk Powershell Fileless Script Contains Base64 Encoded Content production 2026-06-25
splunk PowerShell PInvoke Process Injection API Chain production 2026-06-25
splunk Powershell Using memory As Backing Store production 2026-06-08
splunk Windows Account Access Removal via Logoff Exec production 2026-05-13
splunk Unloading AMSI via Reflection production 2026-05-13
splunk Recon Using WMI Class production 2026-05-13
splunk PowerShell WebRequest Using Memory Stream production 2026-05-13
splunk PowerShell Script Block With URL Chain production 2026-05-13
splunk Powershell Load Module in Meterpreter production 2026-05-13
splunk Powershell Fileless Process Injection via GetProcAddress production 2026-05-13
splunk Powershell Creating Thread Mutex production 2026-05-13
splunk Exchange PowerShell Module Usage production 2026-05-13
splunk Detect Mimikatz With PowerShell Script Block Logging production 2026-05-13
splunk Detect Empire with PowerShell Script Block Logging production 2026-05-13
splunk Detect Certify With PowerShell Script Block Logging production 2026-05-13
splunk Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity production 2026-05-13
splunk Windows Software Discovery Via PowerShell production 2026-05-13
splunk Windows Shell Process from CrushFTP production 2026-05-13
splunk Windows PowGoop Beacon Decoding production 2026-05-13
splunk Windows PowerShell WMI Win32 ScheduledJob production 2026-05-13
splunk Windows PowerShell Script TabExpansion Direct Call production 2026-05-13
splunk Windows PowerShell Script From WindowsApps Directory production 2026-05-13
splunk Windows Powershell RemoteSigned File production 2026-05-13
splunk Windows PowerShell Process Implementing Manual Base64 Decoder production 2026-05-13
splunk Windows PowerShell MSIX Package Installation production 2026-05-13
splunk Windows PowerShell Module File Created production 2026-05-13
sigma Cmd.EXE Missing Space Characters Execution Anomaly test 2026-05-13
splunk Windows PowerShell Invoke-Sqlcmd Execution production 2026-05-13
splunk Windows PowerShell Invoke-RestMethod IP Information Collection production 2026-05-13
splunk Windows MSExchange Management Mailbox Cmdlet Usage production 2026-05-13
splunk Windows Explorer LNK Exploit Process Launch With Padding production 2026-05-13
splunk Windows Explorer.exe Spawning PowerShell or Cmd production 2026-05-13
splunk Windows Enable PowerShell Web Access production 2026-05-13
splunk Windows Default Cobalt Strike PowerShell Beacon production 2026-05-13
splunk Windows Cobalt Strike PowerShell Loader production 2026-05-13
splunk Nishang PowershellTCPOneLine production 2026-05-13
splunk Malicious PowerShell Process With Obfuscation Techniques production 2026-05-13
splunk GetWmiObject User Account with PowerShell Script Block production 2026-05-13
splunk GetLocalUser with PowerShell Script Block production 2026-05-13
splunk Get-ForestTrust with PowerShell Script Block production 2026-05-13
splunk Powershell Defender Threat Actions Set to Allow production 2026-05-12
sigma Potential WinAPI Calls Via PowerShell Scripts test 2026-04-29
sigma PowerShell Download Via Net.WebClient - PowerShell Classic test 2026-04-28
sigma Invoke-Obfuscation Obfuscated IEX Invocation test 2026-03-16
sigma Invoke-Obfuscation Via Stdin test 2026-03-16
sigma Invoke-Obfuscation Via Use Clip test 2026-03-16
sigma BloodHound Collection Files test 2026-02-19
sigma Potentially Suspicious Powershell Script Execution From Temp Folder test 2026-02-17
sigma Malicious PowerShell Scripts - PoshModule test 2025-12-10
sigma Malicious PowerShell Commandlets - ScriptBlock test 2025-12-10
sigma Malicious PowerShell Commandlets - PoshModule test 2025-12-10
sigma Malicious PowerShell Commandlets - ProcessCreation test 2025-12-10
sigma Malicious PowerShell Scripts - FileCreation test 2025-12-10
sigma AppLocker Prevented Application or Script from Running test 2025-12-03
sigma Uncommon PowerShell Hosts test 2025-10-22
sigma Suspicious Non PowerShell WSMAN COM Provider test 2025-10-22
sigma Usage Of Web Request Commands And Cmdlets - ScriptBlock test 2025-10-20
sigma PowerShell Download Pattern test 2025-10-20
sigma Usage Of Web Request Commands And Cmdlets test 2025-10-20
sigma Potential Data Exfiltration Activity Via CommandLine Tools test 2025-10-19
sigma Turla Group Commands May 2020 test 2025-10-19
sigma Change PowerShell Policies to an Insecure Level test 2025-10-07
sigma Potential Exploitation of GoAnywhere MFT Vulnerability experimental 2025-10-07
sigma Alternate PowerShell Hosts Pipe test 2025-10-07
sigma Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309) experimental 2025-08-01
sigma Potential DLL File Download Via PowerShell Invoke-WebRequest test 2025-07-18
sigma PowerShell MSI Install via WindowsInstaller COM From Remote Location experimental 2025-06-05
sigma Obfuscated PowerShell MSI Install via WindowsInstaller COM experimental 2025-05-27
sigma Obfuscated PowerShell OneLiner Execution test 2025-04-16
sigma Suspicious CrushFTP Child Process experimental 2025-04-10
sigma Potential PowerShell Obfuscation Via WCHAR/CHAR test 2025-03-03
sigma Non Interactive PowerShell Process Spawned test 2025-02-28
sigma Nslookup PowerShell Download Cradle test 2025-02-25
sigma Suspicious PowerShell Invocations - Specific test 2025-02-17
sigma Suspicious PowerShell Invocations - Specific - PowerShell Module test 2025-02-17
sigma Kalambur Backdoor Curl TOR SOCKS Proxy Execution experimental 2025-02-11
sigma Renamed Powershell Under Powershell Channel test 2025-01-20
sigma bXOR Operator Usage In PowerShell Command Line - PowerShell Classic test 2024-12-11
sigma Potentially Suspicious Command Executed Via Run Dialog Box - Registry test 2024-11-01
sigma UNC2452 Process Creation Patterns test 2024-09-12
sigma PowerShell Web Access Installation - PsScript test 2024-09-03
sigma FakeUpdates/SocGholish Activity test 2024-08-23
sigma Potential APT FIN7 Exploitation Activity test 2024-07-29
sigma Powershell Executed From Headless ConHost Process test 2024-07-23
sigma Headless Process Launched Via Conhost.EXE test 2024-07-23
sigma Potentially Suspicious PowerShell Child Processes test 2024-07-16
sigma DSInternals Suspicious PowerShell Cmdlets - ScriptBlock test 2024-06-26
sigma DSInternals Suspicious PowerShell Cmdlets test 2024-06-26
sigma Potential PowerShell Command Line Obfuscation test 2024-04-15
sigma Invoke-Obfuscation Via Use Clip - Powershell test 2024-04-15
sigma Invoke-Obfuscation VAR+ Launcher test 2024-04-15
sigma Invoke-Obfuscation STDIN+ Launcher test 2024-04-15
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation CLIP+ Launcher - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation STDIN+ Launcher - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell test 2024-04-05
sigma Invoke-Obfuscation VAR+ Launcher - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation Via Stdin - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation Via Stdin - Powershell test 2024-04-05
sigma Invoke-Obfuscation VAR+ Launcher - PowerShell test 2024-04-05
sigma Invoke-Obfuscation Via Use Clip - PowerShell Module test 2024-04-05
sigma Invoke-Obfuscation STDIN+ Launcher - Powershell test 2024-04-05
sigma Invoke-Obfuscation CLIP+ Launcher - PowerShell test 2024-04-05
sigma Network Connection Initiated By PowerShell Process test 2024-03-13
sigma Potential Remote PowerShell Session Initiated test 2024-02-02
sigma PowerShell ShellCode test 2024-01-25
sigma Remote PowerShell Session (PS Classic) test 2024-01-03
sigma Change PowerShell Policies to an Insecure Level - PowerShell test 2023-12-14
sigma Invocation Of Crypto-Classes From The "Cryptography" PowerShell Namespace test 2023-12-01
sigma Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace test 2023-12-01
sigma New PowerShell Instance Created test 2023-11-30
sigma Remote LSASS Process Access Through Windows Remote Management stable 2023-11-29
sigma PowerView PowerShell Cmdlets - ScriptBlock test 2023-11-22
sigma Remote Thread Creation Via PowerShell In Uncommon Target test 2023-11-10
sigma Remote Thread Creation Via PowerShell test 2023-11-10
sigma Execute Code with Pester.bat test 2023-11-09
sigma Lace Tempest PowerShell Launcher test 2023-11-09
sigma Lace Tempest PowerShell Evidence Eraser test 2023-11-09
sigma HackTool - CrackMapExec Execution Patterns stable 2023-11-06
sigma Netcat The Powershell Version test 2023-10-27
sigma PowerShell Downgrade Attack - PowerShell test 2023-10-27
sigma PowerShell Called from an Executable Version Mismatch test 2023-10-27
sigma Potentially Suspicious WebDAV LNK Execution test 2023-08-21
sigma WinAPI Function Calls Via PowerShell Scripts test 2023-07-21
sigma WinAPI Library Calls Via PowerShell Scripts test 2023-07-21
sigma Scheduled Task Executing Payload from Registry test 2023-07-18
sigma Malicious PowerShell Keywords test 2023-06-20
sigma Potential PowerShell Obfuscation Via Reversed Commands test 2023-05-31
sigma Windows Shell/Scripting Processes Spawning Suspicious Programs test 2023-05-23
sigma Certificate Exported Via PowerShell test 2023-05-18
sigma Potential APT FIN7 POWERHOLD Execution test 2023-05-04
sigma Potential POWERTRASH Script Execution test 2023-05-04
sigma Rorschach Ransomware Execution Activity test 2023-04-22
sigma Potential Suspicious PowerShell Keywords test 2023-04-21
sigma Unusually Long PowerShell CommandLine test 2023-04-14
sigma HTML Help HH.EXE Suspicious Child Process test 2023-04-12
sigma Suspicious HH.EXE Execution test 2023-04-12
sigma PowerShell Base64 Encoded FromBase64String Cmdlet test 2023-04-06
sigma Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call test 2023-04-06
sigma PowerShell Base64 Encoded Invoke Keyword test 2023-04-06
sigma PowerShell Base64 Encoded IEX Cmdlet test 2023-04-06
sigma Suspicious Encoded PowerShell Command Line test 2023-04-06
sigma Potential Powershell ReverseShell Connection stable 2023-04-05
sigma Silence.EDA Detection test 2023-04-03
sigma Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell stable 2023-03-29
sigma Exchange PowerShell Snap-Ins Usage test 2023-03-24
sigma MERCURY APT Activity test 2023-03-10
sigma Greenbug Espionage Group Indicators test 2023-03-09
sigma HackTool - CrackMapExec Execution test 2023-03-08
sigma Potential Baby Shark Malware Activity test 2023-03-08
sigma HackTool - Default PowerSploit/Empire Scheduled Task Creation test 2023-03-03
sigma HackTool - Empire PowerShell Launch Parameters test 2023-02-21
sigma HackTool - Covenant PowerShell Launcher test 2023-02-21
sigma HackTool - CrackMapExec PowerShell Obfuscation test 2023-02-21
sigma Suspicious File Execution From Internet Hosted WebDav Share test 2023-02-21
sigma Invoke-Obfuscation CLIP+ Launcher - System test 2023-02-20
sigma Potential BlackByte Ransomware Activity test 2023-02-08
sigma Scheduled Task Executing Encoded Payload from Registry test 2023-02-04
sigma HackTool - Bloodhound/Sharphound Execution test 2023-02-04
sigma Potential Emotet Activity stable 2023-02-04
sigma Suspicious PowerShell Parent Process test 2023-02-04
sigma Potential Persistence Via Powershell Search Order Hijacking - Task test 2023-02-03
sigma ConvertTo-SecureString Cmdlet Usage Via CommandLine test 2023-02-01
sigma Suspicious XOR Encoded PowerShell Command test 2023-01-30
sigma PowerShell Base64 Encoded WMI Classes test 2023-01-30
sigma PowerShell Base64 Encoded Reflective Assembly Load test 2023-01-30
sigma Potential Encoded PowerShell Patterns In CommandLine test 2023-01-26
sigma Base64 Encoded PowerShell Command Detected test 2023-01-26
sigma Exploited CVE-2020-10189 Zoho ManageEngine test 2023-01-21
sigma Remote PowerShell Session (PS Module) test 2023-01-20
sigma Suspicious PowerShell Download - PoshModule test 2023-01-20
sigma Powershell XML Execute Command test 2023-01-19
sigma Malicious Nishang PowerShell Commandlets test 2023-01-16
sigma Import PowerShell Modules From Suspicious Directories - ProcCreation test 2023-01-10
sigma Import PowerShell Modules From Suspicious Directories test 2023-01-10
sigma Potential PowerShell Obfuscation Using Character Join test 2023-01-09
sigma Net WebClient Casing Anomalies test 2023-01-05
sigma Suspicious PowerShell Encoded Command Patterns test 2023-01-05
sigma Malicious Base64 Encoded PowerShell Keywords in Command Lines test 2023-01-05
sigma Suspicious Execution of Powershell with Base64 test 2023-01-05
sigma Suspicious PowerShell Invocation From Script Engines test 2023-01-05
sigma Invoke-Obfuscation Via Use MSHTA - PowerShell Module test 2023-01-04
sigma Potential PowerShell Downgrade Attack test 2023-01-04
sigma Suspicious PowerShell Invocations - Generic - PowerShell Module test 2023-01-03
sigma Suspicious PowerShell Invocations - Generic test 2023-01-03
sigma PowerShell Remote Session Creation test 2023-01-02
sigma Malicious ShellIntel PowerShell Commandlets test 2023-01-02
sigma Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module test 2022-12-31
sigma Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell test 2022-12-31
sigma Invoke-Obfuscation COMPRESS OBFUSCATION test 2022-12-29
sigma WMImplant Hack Tool test 2022-12-25
sigma Bad Opsec Powershell Code Artifacts test 2022-12-25
sigma PowerShell PSAttack test 2022-12-25
sigma PowerShell Credential Prompt test 2022-12-25
sigma Powershell Inline Execution From A File test 2022-12-25
sigma NTFS Alternate Data Stream test 2022-12-25
sigma PowerShell Create Local User test 2022-12-25
sigma Detection of PowerShell Execution via Sqlps.exe test 2022-12-09
sigma Suspicious PowerShell Download - Powershell Script test 2022-12-02
sigma Invoke-Obfuscation Via Use MSHTA - System test 2022-11-29
sigma Invoke-Obfuscation STDIN+ Launcher - Security test 2022-11-29
sigma Invoke-Obfuscation VAR+ Launcher - Security test 2022-11-29
sigma Invoke-Obfuscation COMPRESS OBFUSCATION - Security test 2022-11-29
sigma Invoke-Obfuscation RUNDLL LAUNCHER - Security test 2022-11-29
sigma Invoke-Obfuscation Via Stdin - Security test 2022-11-29
sigma Invoke-Obfuscation Via Use Clip - Security test 2022-11-29
sigma Invoke-Obfuscation Via Use MSHTA - Security test 2022-11-29
sigma Invoke-Obfuscation Via Use Rundll32 - PowerShell test 2022-11-29
sigma Invoke-Obfuscation Via Use MSHTA - PowerShell test 2022-11-29
sigma Invoke-Obfuscation Via Use Rundll32 - Security test 2022-11-29
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security test 2022-11-29
sigma Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell test 2022-11-29
sigma Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell test 2022-11-29
sigma Invoke-Obfuscation STDIN+ Launcher - System test 2022-11-29
sigma Invoke-Obfuscation VAR+ Launcher - System test 2022-11-29
sigma Invoke-Obfuscation COMPRESS OBFUSCATION - System test 2022-11-29
sigma Invoke-Obfuscation RUNDLL LAUNCHER - System test 2022-11-29
sigma Invoke-Obfuscation Via Stdin - System test 2022-11-29
sigma Invoke-Obfuscation Via Use Clip - System test 2022-11-29
sigma Invoke-Obfuscation Via Use Rundll32 - PowerShell Module test 2022-11-29
sigma Invoke-Obfuscation Via Use Rundll32 - System test 2022-11-29
sigma Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module test 2022-11-29
sigma Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module test 2022-11-29
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System test 2022-11-29
sigma Suspicious PowerShell IEX Execution Patterns test 2022-11-28
sigma Invoke-Obfuscation CLIP+ Launcher - Security test 2022-11-27
sigma Operation Wocao Activity - Security test 2022-11-27
sigma Invoke-Obfuscation CLIP+ Launcher test 2022-11-17
sigma Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION test 2022-11-16
sigma Remote PowerShell Session Host Process (WinRM) test 2022-10-09
sigma UNC2452 PowerShell Pattern test 2022-10-09
sigma Operation Wocao Activity test 2022-10-09
sigma Remote PowerShell Sessions Network Connections (WinRM) test 2022-10-09
sigma PSAsyncShell - Asynchronous TCP Reverse Shell test 2022-10-04
sigma Potential Bumblebee Remote Thread Creation test 2022-09-27
sigma PowerShell ADRecon Execution test 2022-09-06
sigma Execute Code with Pester.bat as Parent test 2022-08-20
sigma Suspicious Interactive PowerShell as SYSTEM test 2022-08-13
sigma Suspicious Schtasks Execution AppData Folder test 2022-07-28
sigma PowerShell Script Run in AppData test 2022-07-14
sigma Suspicious PowerShell Parameter Substring test 2022-07-14
sigma Execution of Powershell Script in Public Folder test 2022-07-14
sigma AWS EC2 Startup Shell Script Change test 2022-06-07
sigma Powershell MsXml COM Object test 2022-05-19
sigma Raspberry Robin Subsequent Execution of Commands test 2022-05-06
sigma Raspberry Robin Initial Execution From External Drive test 2022-05-06
sigma CVE-2022-24527 Microsoft Connected Cache LPE test 2022-04-13
sigma Invoke-Obfuscation Via Use MSHTA test 2022-03-08
sigma Suspicious PowerShell Download and Execute Pattern test 2022-03-01
sigma SQL Client Tools PowerShell Session Detection test 2022-02-25
sigma Hidden Powershell in Link File Pattern test 2022-02-06
sigma ChromeLoader Malware Execution test 2022-01-10
sigma Suspicious PrinterPorts Creation (CVE-2020-1048) test 2021-11-27
sigma Command Line Execution with Suspicious URL and AppData Strings test 2021-11-27
elastic PowerShell spawning Cmd deprecated 2021-04-15
sigma TropicTrooper Campaign November 2018 stable 2020-08-27
sentinel Exchange Worker Process Making Remote Call Scheduled —
sentinel Azure VM Run Command operations executing a unique PowerShell script Scheduled —
sentinel A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) Scheduled —