Powershell

This threat brief details the detection of suspicious PowerShell Invoke-WebRequest activity used to download payloads into high-risk, world-writable directories on Windows systems.

Detection logic for identifying PowerShell execution utilizing excessive special characters for command line obfuscation to bypass security monitoring.

This brief documents a detection method for the use of PowerShell to trigger MSI installations through the WMI Win32_Product class, a technique often utilized for software deployment or unauthorized persistence.

Adversaries utilize PowerShell commands to modify file system metadata, specifically targeting creation, access, and modification timestamps to evade detection and hinder forensic analysis.

Adversaries frequently use the PowerShell Compress-Archive cmdlet to stage sensitive data for exfiltration within common temporary directories, a technique used to consolidate and obfuscate collected information.

Adversaries utilize the PowerShell WindowStyle parameter to execute scripts in a hidden window, a technique often used to conceal malicious activity from user visibility.

Detection logic for PowerShell scripts utilizing the Start-Process cmdlet with the -PassThru parameter to execute processes in the background, a technique often used for stealthy execution.

Adversaries utilize automated PowerShell reconnaissance commands combined with redirection to temporary files to collect and stage system information for exfiltration.

Adversaries may use the New-PSDrive PowerShell cmdlet to map administrative network shares via SMB for lateral movement and remote file interaction.

Adversaries use PowerShell scripts leveraging Outlook COM objects to programmatically access and exfiltrate user email data from local systems.

Adversaries manipulate the User-Agent string in PowerShell web requests to masquerade C2 traffic as legitimate browser or application activity.

Adversaries may use Hyper-V PowerShell cmdlets to create and manipulate virtual machines to conceal malicious activity or establish persistence.

Adversaries use PowerShell to search local file systems and network shares for files containing embedded or insecurely stored credentials.

Adversaries often abuse PowerShell to invoke batch files, allowing for sequential command execution and complex logic within the Windows environment.

Detection of PowerShell scripts utilizing specific cmdlets to recursively enumerate file system directories, a technique historically associated with MAZE ransomware discovery operations.

Adversaries utilize PowerShell commands to recursively search for sensitive file extensions such as .pass and .kdbx to identify credentials or keys stored on disk.

Detection logic for PowerShell scripts leveraging the .NET KerberosRequestorSecurityToken class to illicitly request Kerberos tickets, a common step in Kerberoasting.

Adversaries utilize the New-PSSession cmdlet to establish remote PowerShell sessions for lateral movement and command execution within Windows environments.

Adversaries are utilizing the Get-ADComputer PowerShell cmdlet to enumerate Active Directory objects configured for unconstrained delegation, a reconnaissance step often preceding ticket-based credential theft.

Adversaries may use the legitimate Windows PowerShell cmdlet Start-NetEventSession to capture network traffic and perform reconnaissance or credential theft.

Adversaries leverage the RegisterXLL COM method via PowerShell to execute malicious add-ins and achieve persistence within Microsoft Office environments.

Adversaries leverage the MSXML2 COM object within PowerShell scripts to facilitate network communication and potential code execution.

Adversaries may modify Group Policy settings via PowerShell to impair defensive capabilities or maintain persistence within a Windows environment.

Adversaries leverage native PowerShell cmdlets to manage and manipulate local user accounts for persistence and privilege escalation.

Adversaries utilize PowerShell scripts to interface with user32.dll for monitoring user keystrokes to facilitate credential theft.

Adversaries utilize the DNSExfiltrator tool to tunnel file data through covert DNS requests, bypassing traditional network egress filtering.

Adversaries leverage the PowerShell Invoke-Command cmdlet to perform lateral movement and execute arbitrary code on remote Windows hosts via WinRM.

This brief documents a detection method for identifying potentially malicious PowerShell scripts that decode base64-encoded Gzip archives to facilitate in-memory code execution.

Adversaries may enable Windows Remote Management (WinRM) to facilitate lateral movement and remote code execution on compromised systems.

Adversaries leverage PowerShell scripts to programmatically access and extract stored credentials from the Windows Credential Manager vault.

This brief documents the use of .NET reflection techniques within PowerShell to execute arbitrary code in-memory, a method frequently utilized to bypass file-based security controls.

Adversaries may use the System.DirectoryServices.AccountManagement namespace in PowerShell to programmatically create or manipulate domain accounts for persistence within Active Directory environments.

Detection of suspicious PowerShell scripts utilizing System.DirectoryServices.DirectorySearcher to enumerate Active Directory computer objects, a technique often used in reconnaissance.

Adversaries utilize PowerShell commands to query WMI objects and check for virtualization artifacts to evade sandbox and analysis environments.

Adversaries leverage native Windows PowerShell cmdlets to register, configure, and execute unauthorized scheduled tasks for persistence and lateral movement.

Adversaries use the .NET CopyFromScreen method within PowerShell scripts to capture desktop screenshots for information gathering during post-compromise operations.

Adversaries utilize automated PowerShell scripts to locate and gather sensitive documents across local file systems for subsequent exfiltration.

Detection of PowerShell activity used to enumerate Active Directory accounts with the DONT_REQ_PREAUTH flag, a precursor to AS-REP roasting attacks.

This brief documents a comprehensive set of offensive PowerShell script names and execution patterns frequently used by threat actors for reconnaissance, credential harvesting, and lateral movement, detectable via PowerShell Module Logging.

Detection of PowerShell processes creating executable or script files in non-standard directories, a common behavior used by malware for persistence and staging.

Adversaries utilize PowerShell parameter substring truncation to evade command-line monitoring by leveraging the built-in ability of PowerShell to parse shortened, non-standard parameter names.

Adversaries frequently leverage specific PowerShell cmdlets to download and execute malicious payloads, a common technique observed in stagers and ransomware deployment campaigns.

Adversaries utilize PowerShell to copy the Security Account Manager (SAM) registry hive from shadow copies for offline credential extraction.

Detection of attackers using NTFS Alternate Data Streams (ADS) to hide and execute malicious PowerShell scripts, effectively bypassing simple file-based scanning.

Adversaries may use PowerShell to enumerate the Local Security Authority Subsystem Service (LSASS) process as a precursor to credential dumping or process injection.

This brief documents the use of the 'FromBase64String' method within PowerShell command lines, a common technique for obfuscating malicious payloads to bypass signature-based detection.

The DSInternals PowerShell module is frequently abused by threat actors to perform unauthorized credential dumping, Active Directory offline database manipulation, and password auditing.

This brief documents common PowerShell patterns used by threat actors, including FIN7, to download and execute arbitrary payloads directly into memory using download cradles.

Detection engineering brief covering the identification of malicious PowerShell scripts leveraging Windows API calls for process injection, token manipulation, and in-memory execution.

This brief documents detection logic for common PowerShell obfuscation and execution patterns frequently leveraged by attackers to maintain persistence, bypass security policies, and download secondary payloads.

PowerView is an open-source PowerShell module frequently used by threat actors for domain reconnaissance, user enumeration, and identifying lateral movement opportunities.

Adversaries utilize NTFS Alternate Data Streams (ADS) to conceal malicious payloads and configuration data on Windows systems by appending information to existing files.

This brief documents detection signatures for the Nishang offensive PowerShell framework, a collection of scripts used for post-exploitation, lateral movement, and credential theft.

This brief documents a comprehensive list of commandlet patterns associated with common PowerShell-based exploitation frameworks, privilege escalation tools, and post-exploitation modules used by threat actors.

This brief documents detection logic for the DSInternals PowerShell module, a toolkit frequently leveraged by threat actors to perform unauthorized offline manipulation of Active Directory databases and extraction of cryptographic material.

Adversaries often attempt to clear PowerShell command history to conceal malicious activities conducted during a security incident.

This brief documents patterns of PowerShell invocation commonly associated with malicious activities such as payload downloading, fileless execution, and persistence establishment.

Detection of potentially malicious PowerShell script execution originating from common temporary directory paths, often indicative of staged payload execution.

This brief covers the detection of suspicious PowerShell activity involving the use of web download cmdlets to retrieve and save DLL files to the local file system.

Detection of the ConvertTo-SecureString cmdlet usage via command-line, which is often used in adversarial scripts to handle credentials or obfuscated strings.

This detection brief identifies common malicious PowerShell command line patterns that utilize Base64 encoded arguments frequently observed in malware infection stages.

Detection of malicious PowerShell execution patterns involving Base64 encoded commands, frequently utilized by malware families such as Emotet for obfuscated payload delivery.

Adversaries utilize PowerShell to establish persistence and achieve privilege escalation by creating WMI event subscriptions that execute malicious payloads upon system triggers.

This brief documents a detection capability for identifying potential command-and-control activity where adversaries use PowerShell to test network connectivity over non-standard, uncommon ports.

Adversaries utilize PowerShell to store malicious payloads within NTFS Alternate Data Streams (ADS) to evade detection and maintain stealthy persistence.

This detection targets anomalous network connections over WinRM ports 5985 and 5986 that originate from non-network service accounts, a common indicator of unauthorized remote PowerShell execution or lateral movement.

This brief documents detection logic for PowerShell command-line obfuscation methods commonly utilized by the Invoke-Obfuscation framework to bypass security monitoring.

Adversaries utilize PowerShell's Set-MpPreference cmdlet to disable Windows Defender security features and modify threat handling behavior, facilitating persistence and stealth.

Adversaries frequently use PowerShell to interface with WMI objects and delete Volume Shadow Copies, a technique commonly associated with ransomware to prevent system recovery.

Adversaries leverage the Disable-WindowsOptionalFeature PowerShell cmdlet to disable security features like Windows Defender, facilitating defense impairment and persistence.

Adversaries utilize PowerShell commands to move malicious DLLs into protected Windows system directories, a technique commonly associated with persistence and credential access.

The abuse of the Unblock-File cmdlet is used by attackers to bypass Mark-of-the-Web (MotW) protections on downloaded files, facilitating the execution of malicious payloads.

Adversaries may use PowerShell to open a handle to disk volumes via DOS device paths to perform direct, unauthorized file system access or bypass security controls.

Adversaries use PowerShell script blocks to enumerate active security software processes by filtering system process listings for known defensive product names and company identifiers.

Detection of the Get-ADReplAccount cmdlet from the DSInternals toolkit, which is frequently used by adversaries for unauthorized Active Directory credential dumping.

Adversaries can utilize PowerShell to programmatically create Volume Shadow Copies, enabling the offline extraction of sensitive files like the Active Directory ntds.dit database.

Detection of attackers using PowerShell to download executable, script, or library files from untrusted remote domains as part of command and control activity.

Detection of adversarial reconnaissance activities leveraging the Get-AppLockerPolicy PowerShell cmdlet to map host-based application execution restrictions.

Adversaries may use Active Directory Service Interfaces (ADSI) within PowerShell to create local or domain accounts, effectively bypassing standard monitoring for typical user-creation commands.

This brief describes a detection methodology for identifying malware utilizing DNS TXT records to retrieve commands via PowerShell to bypass network egress restrictions.

This threat brief details a detection for the suspicious loading of PowerShell Core DLLs by non-PowerShell processes, a technique often employed by attackers to execute PowerShell code stealthily and evade security monitoring.

This brief describes a detection opportunity for the stealthy creation of the 'PSScriptPolicyTest' PowerShell script by processes other than standard PowerShell executables or legitimate Windows components, a behavior potentially indicative of advanced adversaries attempting to bypass PowerShell logging and security policies.

Elastic's machine learning job detects rare PowerShell script executions on Windows hosts, identified by their script block hash, indicating potential malware activity or persistence mechanisms that deviate from an established baseline.

This brief details the detection of suspicious PowerShell script execution that targets the discovery of installed anti-virus and anti-spyware products using WMI or PowerShell commands, a common reconnaissance tactic employed by malicious actors to map security applications and potentially evade defenses.

A Russian-speaking threat actor known as 'bandcampro' is using Google's open-source Gemini CLI to manage and control a botnet of eight compromised dental clinic computers, facilitating activities such as password cracking, C2 infrastructure migration, and planning cryptocurrency fraud.

Microsoft Defender Experts observed increased ACR Stealer activity from late April to mid-June 2026, using ClickFix social engineering lures in two distinct campaigns to steal browser credentials, authentication tokens, and sensitive documents from enterprise environments via WebDAV-based Python loaders or MSHTA-initiated PowerShell with steganography.

UAT-11795, a sophisticated and financially motivated Russian-speaking threat actor, targets users in the U.S. and Europe with trojanized software installers to deploy custom Python-based Starland RAT and an in-memory PowerShell WLDR agent for credential theft and cryptocurrency exfiltration.

A threat actor was observed in early June 2026 using AI-generated PowerShell scripts for Active Directory enumeration and then deploying s5cmd for data exfiltration after gaining initial access via RDP, indicating a shift towards AI-augmented tradecraft for rapid and aggressive campaigns.

This brief details the detection of Base64 encoded PowerShell `Invoke-` keywords in command lines, a common stealth technique leveraged by malware families such as Gootloader for initial access, execution, and subsequent payload delivery, enabling evasive command and control.

This brief details the detection of PowerShell scripts that leverage Windows API functions, a common technique employed by threat actors for process injection, token manipulation, and other evasive malicious activities to bypass traditional security controls.

This brief details a PowerShell defense evasion technique where adversaries utilize the `Start-Process` cmdlet with the `-PassThru` parameter to execute commands or programs in a hidden, background manner, enabling covert persistent access or malicious payload execution on Windows systems.

This brief describes the detection of adversaries leveraging the `Get-Clipboard` PowerShell commandlet, identified through PowerShell Script Block Logging (EventCode 4104), to steal sensitive information such as credentials or PII from the Windows clipboard during the collection phase of an attack, potentially leading to unauthorized access and further compromise.

A high-severity vulnerability (GHSA-j472-gf56-x589) in OpenClaw allows an attacker to bypass allowlist checks for PowerShell encoded commands by using abbreviated encoded-command flags, leading to unauthorized code execution on the underlying Windows system if a vulnerable feature is enabled and reachable.

Unspecified adversaries are using a Traffic Direction System (TDS) redirect for initial access, followed by encoded PowerShell execution to download payloads like `script.ps1` into the `ApplicationData` directory, and establishing command-and-control (C2) communication via `curl.exe` to suspicious IP addresses such as `144.31.221.82` with defense evasion techniques like post-execution cleanup, designed to operate below traditional detection thresholds.

This rule detects the abuse of Azure Virtual Machine Run Command to execute scripts remotely, correlating Azure Activity Log events with endpoint process starts, identifying instances where adversaries use Run Command to run scripts as SYSTEM or root.

Detects the use of PowerShell to delete volume shadow copies, a tactic commonly employed by ransomware and other destructive attacks to hinder data recovery efforts.

A malicious repository on Hugging Face, impersonating OpenAI's 'Privacy Filter' project, distributed information-stealing malware to Windows users by executing a PowerShell command that downloads and runs a Rust-based infostealer, which exfiltrates collected data to a command-and-control server.

This detection identifies potentially obfuscated PowerShell scripts based on high entropy and non-uniform character distributions, often used by attackers to evade signature-based detections and hinder analysis.

This rule identifies the execution of PowerShell with suspicious argument values, often observed during malware installation, by detecting unusual PowerShell arguments indicative of abuse, focusing on patterns like encoded commands, suspicious downloads, and obfuscation techniques.

An improper input validation vulnerability (CVE-2026-26143) in Microsoft PowerShell allows an unauthorized local attacker to bypass security features.

Adversaries may leverage Powercat, a PowerShell implementation of Netcat, to establish command and control channels or perform lateral movement within a compromised network.

Adversaries may use the `New-MailboxExportRequest` PowerShell cmdlet to export mailboxes to PST files for sensitive data collection.

This rule detects suspicious PowerShell arguments often used during malware installation, including encoded commands, file downloads, and obfuscation techniques.

This rule detects PowerShell scripts associated with NTLM relay or pass-the-hash tooling and SMB/NTLM negotiation artifacts, indicating potential credential access and lateral movement attempts by attackers.

Detects potential credential decryption operations by PowerShell or unsigned processes using the Veeam.Backup.Common.dll library, indicating potential credential access attempts to target backups as part of destructive operations.

Adversaries may clear the command history of a compromised account to conceal the actions undertaken during an intrusion on a Windows system.

This brief highlights the importance of PowerShell and script logging to improve threat detection capabilities within an organization's environment, focusing on increased visibility into malicious activities.

Adversaries may execute PowerShell commands through the Windows Script Host (wscript.exe or cscript.exe) using suspicious arguments, potentially bypassing traditional PowerShell execution policies and detection mechanisms.

Detection of PowerShell scripts attempting to dump Kerberos tickets from memory by accessing LSA authentication packages, potentially leading to credential access and lateral movement.

This detection identifies PowerShell scripts leveraging Win32 APIs for memory allocation, process access, and thread creation, indicative of potential process injection or in-memory payload execution on Windows systems.

This rule detects potential PowerShell HackTool scripts by identifying script block content containing known offensive-tool author handles or attribution strings, indicative of attackers using public tooling with minimal modifications.

This rule detects PowerShell scripts that attempt to bypass the Antimalware Scan Interface (AMSI) in order to disable scanning and execute malicious PowerShell code undetected.

Detection of PowerShell scripts employing ShareFinder functions or Windows share enumeration APIs to discover accessible network shares for reconnaissance, lateral movement, or ransomware deployment.

This rule detects potential PowerShell obfuscated scripts by identifying script blocks with high entropy and non-uniform character distributions, which attackers use to evade signature-based detections.

The Invoke-NinjaCopy PowerShell script is used by attackers to directly access volume files, such as NTDS.dit or registry hives, for credential dumping.

Detection of suspicious arguments used with PowerShell, potentially indicating malicious activity execution.

Attackers may disable PowerShell Script Block Logging by modifying the registry to conceal their activities on the host and evade detection by setting the `EnableScriptBlockLogging` registry value to 0, impacting security monitoring and incident response capabilities.

This rule identifies PowerShell script blocks linked to multiple distinct PowerShell detections via the same ScriptBlock ID, indicating compound suspicious behavior associated with chained obfuscation, decoding, and execution within a single script block.

Attackers use PowerShell commands, including base64-encoded variants, to disable or weaken Windows Defender settings, impairing defenses on compromised systems.

This rule identifies remote execution via Windows PowerShell remoting, which allows a user to run any Windows PowerShell command on one or more remote computers, potentially indicating lateral movement.

This analytic detects PowerShell code that uses P/Invoke to call Windows API functions associated with process injection, such as VirtualAlloc, WriteProcessMemory, and CreateRemoteThread, indicating potential malicious activity.

Detection of PowerShell commands to import AppLocker policy via Import-Module Applocker and Set-AppLockerPolicy, potentially used to enforce restrictive policies or disable security products like antivirus.

The analytic detects suspicious PowerShell script execution involving the cryptography namespace (excluding SHA and MD5) via EventCode 4104, often associated with malware that decrypts or decodes additional malicious payloads leading to further code execution, privilege escalation, or persistence.

Detects PowerShell scripts employing Base64 decoding combined with .NET decompression (Deflate/GZip) to deobfuscate and reconstruct malicious payloads in memory, evading traditional defenses.

This detection identifies PowerShell scripts that directly call the TabExpansion internal function, which is uncommon and may indicate malicious activity, such as TabShell, potentially bypassing sandboxes by loading PowerShell functions via directory traversal.

This brief outlines detection strategies for adversaries leveraging Invoke-Obfuscation techniques within PowerShell scripts executed via standard input, a method commonly used to evade traditional detection mechanisms.

This analytic detects suspicious PowerShell activity leveraging WMI to gather system information, potentially indicating reconnaissance by an attacker.

Detects PowerShell being used to download executable files from untrusted remote destinations, often used by attackers to transfer malware into a compromised environment.

This rule detects PowerShell scripts that build commands from concatenated string literals within dynamic invocation constructs, a technique used by attackers to obscure execution intent, bypass keyword-based detections, and evade AMSI.

This brief outlines the detection of the ConvertTo-AADIntBackdoor command execution via PowerShell Script Block Logging, a technique used to create a backdoor in federated Azure AD domains by modifying federation settings and allowing attackers to control the authentication process.

Detection of PowerShell processes launched by cscript.exe or wscript.exe, indicative of potential malicious initial access or execution attempts.

The analytic detects PowerShell processes using command-line parameters to bypass the execution policy, often used by attackers to run malicious scripts undetected, leading to potential code execution, data exfiltration, or persistence.

A PowerShell command attempting to remove the Windows Defender directory is detected via PowerShell Script Block Logging, potentially indicating an attacker's attempt to disable endpoint protection for further malicious activities.

Detects PowerShell processes spawned by non-interactive parent processes, potentially indicating malicious script execution or automation bypassing user interaction.

This rule identifies instances where the PowerShell engine is loaded by processes other than powershell.exe, potentially indicating attackers attempting to use PowerShell functionality stealthily by using the underlying System.Management.Automation namespace and bypassing PowerShell security features.

Attackers use PowerShell to query the Windows registry's Uninstall key to discover installed software and identify potential vulnerabilities for exploitation.

Adversaries may use PowerShell with specific commands to disable HTTP logging on Windows systems to evade detection and hinder forensic investigations.

Attackers may disable the Windows firewall or its rules using the `Set-NetFirewallProfile` PowerShell cmdlet to enable lateral movement and command and control activity.

Adversaries may attempt to bypass Windows Defender's capabilities by using PowerShell to add exclusions for folders or processes, and this activity can be detected by monitoring PowerShell command lines that use `Add-MpPreference` or `Set-MpPreference` with exclusion parameters.

The execution of the PowerShell command 'Get-Clipboard' is detected to retrieve clipboard data, which may indicate an attempt to steal sensitive information, potentially compromising user accounts.

The creation of a DLL file within PowerShell module directories can indicate malicious PowerShell activity, such as installing new modules or attempts at ScriptBlock smuggling, and this activity is detected using Sysmon Event ID 11.

Detection of Azure AD and cloud management modules installation via PowerShell Script Block Logging, potentially indicating reconnaissance, privilege escalation, or persistence operations by adversaries.

Detection of PowerShell commands used to import AppLocker XML policies, potentially indicating an attempt to bypass security controls, as observed with Azorult malware.

Attackers are using PowerShell commands with specific Set-MpPreference parameters to disable Windows Defender's real-time behavior monitoring, a common tactic for malware to evade detection and persist on compromised systems.

Adversaries employ token obfuscation techniques within PowerShell commands to evade detection by security tools, leveraging methods such as character insertion, string concatenation, and environment variable manipulation to mask their malicious intent.

PowerShell scripts employing .NET cryptography APIs are used to encrypt data for impact or decrypt payloads for defense evasion.

This brief details detection of PowerShell scripts leveraging P/Invoke API calls to perform process injection, covering techniques like self-injection, remote thread injection, APC injection, thread-context hijacking, process hollowing, section-map injection, reflective DLL loading, and DLL injection.

This rule detects PowerShell scripts employing string concatenation to evade static analysis and AMSI by fragmenting keywords or URLs at runtime.

Detects PowerShell scripts using character array reconstruction to hide commands, URLs, or payloads, evading static analysis and AMSI.

This brief detects PowerShell scripts that reference MiniDumpWriteDump or full-memory minidump types, potentially used to capture process memory from credential-bearing processes like LSASS.

This detection identifies Windows PowerShell processes implementing manual Base64 decoding, a technique used by threat actors to obfuscate malicious payloads and evade standard detection mechanisms.

Adversaries use the PowerShell `Get-DomainPolicy` commandlet to enumerate domain password policies for situational awareness and Active Directory discovery, logged via PowerShell Script Block Logging.

This rule detects PowerShell scripts heavily obfuscated with whitespace and special characters, often used to evade static analysis and AMSI, by identifying scripts with low symbol diversity and a high proportion of whitespace and special characters.

The rule detects the use of the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device, potentially allowing attackers to gain persistent access to sensitive email data by adding unauthorized devices.

This detection identifies a DLL decoding and executing the PowGoop config.txt payload, indicating a stage in the MuddyWater infection chain where an obfuscated PowerShell beacon is unwrapped and live C2 communication starts.

An attacker disables the Microsoft Defender 'Block at First Seen' feature to allow potentially malicious files to execute without initial scrutiny, increasing the risk of malware infection and data compromise.

Detects file downloads and access from OneDrive or SharePoint using PowerShell-based user agents, which adversaries leverage with compromised OAuth tokens to exfiltrate data.

Attackers use Invoke-Obfuscation, a PowerShell obfuscation framework, to generate obfuscated IEX (Invoke-Expression) commands, evading detection and executing malicious code.

Attackers can establish persistence by placing a malicious Get-Variable.exe in the WindowsApps folder, hijacking the legitimate PowerShell cmdlet and executing upon PowerShell window initialization, as seen with the Colibri malware.

Adversaries may use the New-MailboxExportRequest PowerShell cmdlet to export mailboxes in Exchange, potentially leading to sensitive information theft.

Detection of successful sign-ins using the Azure Active Directory PowerShell module to identify potentially unauthorized administrative actions in Entra ID.

Detection of modifications to the PowerShell execution policy to 'Unrestricted' or use of the 'Bypass' flag indicates a potential attempt to execute unsigned or malicious scripts, bypassing security controls.

This brief outlines detection strategies for default Cobalt Strike PowerShell beacons, which are used for command and control, by identifying specific function and variable names within PowerShell script block logs.

This analytic detects the execution of a PowerShell script designed to capture screen images on a host, leveraging PowerShell Script Block Logging to identify specific script block text patterns associated with screen capture activities, potentially indicating an attempt to exfiltrate sensitive information via desktop screenshots.

This brief outlines detection strategies for adversaries attempting to retrieve LAPS passwords using PowerShell and the 'ms-Mcs-AdmPwd' property, potentially leading to lateral movement and privilege escalation within a Windows domain.

This brief details a detection for a PowerShell loader pattern commonly used with Cobalt Strike to decompress and execute payloads, often observed in scripted web delivery attacks.

Detection of AMSI (Antimalware Scan Interface) tampering via PowerShell reflection, utilizing PowerShell Script Block Logging (EventCode=4104) to identify commands manipulating `system.management.automation.amsi`, potentially leading to undetected malicious code execution and system compromise.

This analytic detects PowerShell scripts leveraging .NET reflection to load assemblies into memory, a technique commonly used by threat actors to bypass defenses and execute malicious code.

Adversaries use PowerShell to execute malicious code stored in environment variables, leveraging Invoke-Expression or its aliases to bypass static analysis and execute payloads dynamically, as seen in malware loaders and stagers like the VIP Keylogger.

Adversaries may compromise accounts and leverage successful PowerShell authentication in Azure AD to enumerate cloud resources, escalate privileges, and further exploit the Azure environment.

This rule detects PowerShell script block content containing PSReflect-style helper indicators, such as Add-Win32Type, New-InMemoryModule, or DllImport patterns, that may support dynamic Win32 API invocation from PowerShell.

Attackers can establish persistence by creating or modifying PowerShell profiles to execute malicious code each time PowerShell is launched, customizing the user environment.

An adversary may use the Exchange PowerShell cmdlet, Set-CASMailbox, to add a new ActiveSync allowed device, potentially gaining persistent access to a user's email and sensitive information.

Detects PowerShell execution initiated by cscript.exe or wscript.exe, commonly used by attackers for initial access or payload delivery.

This brief covers the detection of suspicious command execution, specifically Cmd.exe or PowerShell.exe, as child processes of legitimate SolarWinds executables, indicative of potential supply chain compromise and unauthorized command execution on Windows systems.

Attackers use PowerShell commands with `Add-MpPreference` or `Set-MpPreference` to create Windows Defender exclusions, allowing malware to execute undetected.

This analytic identifies attempts to disable Windows Defender real-time behavior monitoring via PowerShell commands using `Set-MpPreference`, commonly used by malware to evade detection and potentially leading to data exfiltration or system compromise.

Attackers may disable PowerShell Script Block Logging by modifying the registry to evade detection and conceal their activities on the host, detected by monitoring changes to the `EnableScriptBlockLogging` registry value.

This brief documents a high-severity threat involving PowerShell scripts used for keylogging on Windows systems to capture credentials and sensitive user input.

This rule detects the use of Invoke-Mimikatz or Mimikatz commands within PowerShell scripts to dump credentials, extract password stores, export certificates, or use alternate authentication material, indicating potential in-memory credential access.

Attackers use PowerShell commands like Set-MpPreference or Add-MpPreference, often with base64 encoding, to disable or weaken Windows Defender security settings in order to evade detection and execute malicious payloads.

This brief details the detection of the Level remote management tool PowerShell installer on Windows endpoints, which can be exploited by threat actors for malicious purposes to maintain persistence and execute commands, although it's a legitimate IT tool.

PowerShell scripts use backtick-escaped characters inside `${}` variable expansion to reconstruct strings at runtime, enabling attackers to split keywords, hide commands, and evade static analysis and AMSI.

This rule detects the use of the Set-MpPreference PowerShell command to disable or weaken Windows Defender settings, a common defense evasion tactic.