Skip to content
Threat Feed
Subscribe
high advisory

Detection of Malicious PowerShell Framework Commandlets

This brief provides detection logic for commandlets associated with various PowerShell-based exploitation frameworks, post-exploitation tools, and persistence mechanisms.

Triage facts

Revision 1
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 10, 07:45 UTC
Detection
1 rule
Source quality
A2Roughly even chance

This brief summarizes signatures for identifying malicious PowerShell script blocks. These commandlets are frequently observed in offensive security frameworks, credential theft tools, and backdoor installers. The detection focuses on identifying specific function names within PowerShell Script Block Logging events.

Recommendation

  • Enable PowerShell Script Block Logging (Event ID 4104) across all Windows endpoints.
  • Deploy the provided Sigma rule to your SIEM to monitor for known offensive commandlets.
  • Review any detections for legitimate administrative scripts or internal tooling; tune by filtering out known-good, internally-developed script paths.

Immediate actions

Enable PowerShell Script Block Logging (Event ID 4104) across all Windows hosts.

IT Operations 48h

Threat Hunt

Search PowerShell logs for the presence of known-malicious commandlets extracted from the rule list.

T1059.001 medium high confidence hunt now

Data: PowerShell Event ID 4104

Detection coverage 1

Detect Malicious PowerShell Commandlets

high

Detects commandlet names frequently used in PowerShell-based exploitation frameworks and post-exploitation tools.

sigma tactics: discovery, execution techniques: T1059.001 sources: ps_script, windows

Detection queries are available on the platform. Get full rules →