Cross-source coverage

T1059.001 / ATT&CK

Command and Scripting Interpreter: PowerShell

521 rules · 519 families across 9 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.

A number of PowerShell-based offensive testing tools are available, including Empire, PowerSploit, PoshC2, and PSAttack.

PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the.NET framework and Windows Common Language Interface (CLI).

Tactics
Execution
Platforms
Windows
Telemetry
WinEventLog:SysmonWinEventLog:PowerShell

How MITRE says to detect it DET0455

Abuse of PowerShell for Arbitrary Execution

Windows Analytic 1252

Detects behavioral chains where PowerShell is launched with encoded commands, unusual parent processes, or suspicious modules loaded, potentially followed by network connections or child process spawning. Supports detection of both direct (powershell.exe) and indirect (.NET automation) invocations.

  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:PowerShell EventCode=4103, 4104, 4105, 4106
  • WinEventLog:PowerShell EventCode=400, 403
  • WinEventLog:Sysmon EventCode=7

View on attack.mitre.org ↗

SigmaHQ/sigma

220 rules
Detection Severity Format
Bad Opsec Powershell Code Artifacts Critical Sigma
Greenbug Espionage Group Indicators Critical Sigma
Rorschach Ransomware Execution Activity Critical Sigma
Silence.EDA Detection Critical Sigma
Turla Group Commands May 2020 Critical Sigma
UNC2452 PowerShell Pattern Critical Sigma
AWS EC2 Startup Shell Script Change High Sigma
Base64 Encoded PowerShell Command Detected High Sigma
BloodHound Collection Files High Sigma
ChromeLoader Malware Execution High Sigma

+ 210 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

107 rules
Detection Severity Format
Command and Scripting Interpreter via Windows Scripts High Elastic TOML
Long Base64 Encoded Command via Scripting Interpreter High Elastic TOML
M365 SharePoint/OneDrive File Access via PowerShell High Elastic TOML
Microsoft Exchange Worker Spawning Suspicious Processes High Elastic TOML
Potential AMSI Bypass via RPC Runtime Hooking High Elastic TOML
Potential Antimalware Scan Interface Bypass via PowerShell High Elastic TOML
Potential Command Shell via NetCat High Elastic TOML
Potential Execution via FileFix Phishing Attack High Elastic TOML
Potential Fake CAPTCHA Phishing Attack High Elastic TOML
Potential Malicious PowerShell Based on Alert Correlation High Elastic TOML

+ 97 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

74 rules
Detection Severity Format
Access to Windows Passwords Vault via Powershell Undefined Elastic TOML
AMSI Bypass via PowerShell Undefined Elastic TOML
Attempt to establish VScode Remote Tunnel Undefined Elastic TOML
BCDEdit Safe Mode Command Execution Undefined Elastic TOML
Command and Scripting Interpreter from Suspicious Parent Undefined Elastic TOML
Command Shell Activity Started via RunDLL32 Undefined Elastic TOML
Command Shell Execution from Untrusted Origin Undefined Elastic TOML
Embedded Executable via Windows Shortcut File Undefined Elastic TOML
Encoded Powershell Execution via MsiExec Undefined Elastic TOML
Execution of a Windows Script File Written by a Suspicious Process Undefined Elastic TOML

+ 64 more from elastic/protections-artifacts → showing the 10 highest-severity

splunk/security_content

67 rules
Detection Severity Format
Cisco Secure Firewall - Communication Over Suspicious Ports Undefined SPL
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity Undefined SPL
CrushFTP Authentication Bypass Exploitation Undefined SPL
Detect Certify With PowerShell Script Block Logging Undefined SPL
Detect Empire with PowerShell Script Block Logging Undefined SPL
Detect Mimikatz With PowerShell Script Block Logging Undefined SPL
Exchange PowerShell Module Usage Undefined SPL
Get-ForestTrust with PowerShell Script Block Undefined SPL
GetLocalUser with PowerShell Script Block Undefined SPL
GetWmiObject User Account with PowerShell Script Block Undefined SPL

+ 57 more from splunk/security_content → showing the 10 highest-severity

socfortress/Wazuh-Rules

22 rules
Detection Severity Format
Powershell script: C2/exploitation keyword detected High Wazuh XML
Powershell script: $doit variable detected (exploit scripts) High Wazuh XML
Powershell script: Enable-PSRemoting detected High Wazuh XML
Powershell script: ExecutionPolicy Bypass detected High Wazuh XML
Powershell script: IEX execution detected High Wazuh XML
Powershell script: Invoke-Command (remote execution) detected High Wazuh XML
Powershell script: Invoke-Expression detected High Wazuh XML
Powershell script: MemoryStream usage detected (in-memory execution) High Wazuh XML
Powershell script: Metasploit Meterpreter module detected High Wazuh XML
Powershell script: .NET Assembly reflection loading detected (Empire/Cobalt Strike) High Wazuh XML

+ 12 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

Wazuh Core Ruleset

17 rules
Detection Severity Format
Possible Shimming. Application Compatibility Database launched from an encoded powershell command Critical Wazuh XML
Powershell script used "Invoke-command" cmdlet to execute code on remote computer Critical Wazuh XML
Powershell used to copy SAM hive from VSS Critical Wazuh XML
A powershell process created by WMI executed a base64 encoded command High Wazuh XML
Binary loaded PowerShell automation library - Possible unmanaged Powershell execution by suspicious process High Wazuh XML
Possible addition of new item to Windows startup registry High Wazuh XML
Powershell.exe spawned a powershell process which executed a base64 encoded command High Wazuh XML
Powershell script used "Invoke-command" cmdlet to execute sub script High Wazuh XML
Powershell executed script from suspicious location Medium Wazuh XML
Powershell.exe launched by binary in a suspicious location · win.eventdata.parentImage = (?i)Windows\\\\Temp.+\.(exe|dll), win.eventdata.originalFileName = (?i)PowerShell\.exe Medium Wazuh XML

+ 7 more from Wazuh Core Ruleset → showing the 10 highest-severity

chronicle/detection-rules

6 rules
Detection Severity Format
base64_encoded_powershell_command_detected High YARA-L
powershell_downloadfile High YARA-L
convertto_securestring_cmdlet_usage_via_commandline Medium YARA-L
powershell_web_download Medium YARA-L
ttp_windows_w3wp_launching_encoded_powershell Medium YARA-L
emotet_through_word_document_sysmon_behavior Undefined YARA-L

Azure/Azure-Sentinel

4 rules
Detection Severity Format
A host is potentially running PowerShell to send HTTP(S) requests (ASIM Web Session schema) Medium KQL
Azure VM Run Command operations executing a unique PowerShell script Medium KQL
Exchange Worker Process Making Remote Call Medium KQL
BadUSB HID injection PowerShell via Windows Run dialog Undefined KQL

Bert-JanP/Hunting-Queries-Detection-Rules

4 rules
Detection Severity Format
AMSI Script Detection Undefined KQL
MITRE ATT&CK Mapping Undefined KQL
PowerShell Invoke-Webrequest Undefined KQL
TTP Detection Rule: PowerShell Launching Scripts From WindowsApps Directory (FIN7) Undefined KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.