ATT&CK coverage › Technique
Command and Scripting Interpreter: PowerShell T1059.001
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Events covered
21 catalog events are tagged with this technique by at least one rule.
Authoring guide
Patterns shared across the 229 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (47 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (2879 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.
Common exclusions (12 distinct)
Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 175 rules
- Alternate PowerShell Hosts - PowerShell Module
- Alternate PowerShell Hosts Pipe
- AppLocker Prevented Application or Script from Running
- Bad Opsec Powershell Code Artifacts
- Base64 Encoded PowerShell Command Detected
- BloodHound Collection Files
- Certificate Exported Via PowerShell
- Change PowerShell Policies to an Insecure Level
- Change PowerShell Policies to an Insecure Level - PowerShell
- Cmd.EXE Missing Space Characters Execution Anomaly
- Command Line Execution with Suspicious URL and AppData Strings
- ConvertTo-SecureString Cmdlet Usage Via CommandLine
- Detection of PowerShell Execution via Sqlps.exe
- DSInternals Suspicious PowerShell Cmdlets
- DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
- Exchange PowerShell Snap-Ins Usage
- Execute Code with Pester.bat
- Execute Code with Pester.bat as Parent
- Execution of Powershell Script in Public Folder
- HackTool - Bloodhound/Sharphound Execution
- HackTool - Covenant PowerShell Launcher
- HackTool - CrackMapExec Execution
- HackTool - CrackMapExec Execution Patterns
- HackTool - CrackMapExec PowerShell Obfuscation
- HackTool - Default PowerSploit/Empire Scheduled Task Creation
- HackTool - Empire PowerShell Launch Parameters
- Hidden Powershell in Link File Pattern
- HTML Help HH.EXE Suspicious Child Process
- Import PowerShell Modules From Suspicious Directories
- Import PowerShell Modules From Suspicious Directories - ProcCreation
- Invoke-Obfuscation CLIP+ Launcher
- Invoke-Obfuscation CLIP+ Launcher - PowerShell
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
- Invoke-Obfuscation CLIP+ Launcher - Security
- Invoke-Obfuscation CLIP+ Launcher - System
- Invoke-Obfuscation COMPRESS OBFUSCATION
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
- Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
- Invoke-Obfuscation COMPRESS OBFUSCATION - Security
- Invoke-Obfuscation COMPRESS OBFUSCATION - System
- Invoke-Obfuscation Obfuscated IEX Invocation
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
- Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
- Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
- Invoke-Obfuscation RUNDLL LAUNCHER - Security
- Invoke-Obfuscation RUNDLL LAUNCHER - System
- Invoke-Obfuscation STDIN+ Launcher
- Invoke-Obfuscation STDIN+ Launcher - Powershell
- Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
- Invoke-Obfuscation STDIN+ Launcher - Security
- Invoke-Obfuscation STDIN+ Launcher - System
- Invoke-Obfuscation VAR+ Launcher
- Invoke-Obfuscation VAR+ Launcher - PowerShell
- Invoke-Obfuscation VAR+ Launcher - PowerShell Module
- Invoke-Obfuscation VAR+ Launcher - Security
- Invoke-Obfuscation VAR+ Launcher - System
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security
- Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System
- Invoke-Obfuscation Via Stdin
- Invoke-Obfuscation Via Stdin - Powershell
- Invoke-Obfuscation Via Stdin - PowerShell Module
- Invoke-Obfuscation Via Stdin - Security
- Invoke-Obfuscation Via Stdin - System
- Invoke-Obfuscation Via Use Clip
- Invoke-Obfuscation Via Use Clip - Powershell
- Invoke-Obfuscation Via Use Clip - PowerShell Module
- Invoke-Obfuscation Via Use Clip - Security
- Invoke-Obfuscation Via Use Clip - System
- Invoke-Obfuscation Via Use MSHTA
- Invoke-Obfuscation Via Use MSHTA - PowerShell
- Invoke-Obfuscation Via Use MSHTA - PowerShell Module
- Invoke-Obfuscation Via Use MSHTA - Security
- Invoke-Obfuscation Via Use MSHTA - System
- Invoke-Obfuscation Via Use Rundll32 - PowerShell
- Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
- Invoke-Obfuscation Via Use Rundll32 - Security
- Invoke-Obfuscation Via Use Rundll32 - System
- Malicious Base64 Encoded PowerShell Keywords in Command Lines
- Malicious Nishang PowerShell Commandlets
- Malicious PowerShell Commandlets - PoshModule
- Malicious PowerShell Commandlets - ProcessCreation
- Malicious PowerShell Commandlets - ScriptBlock
- Malicious PowerShell Keywords
- Malicious PowerShell Scripts - FileCreation
- Malicious PowerShell Scripts - PoshModule
- Malicious ShellIntel PowerShell Commandlets
- Net WebClient Casing Anomalies
- New PowerShell Instance Created
- Non Interactive PowerShell Process Spawned
- Nslookup PowerShell Download Cradle
- NTFS Alternate Data Stream
- Obfuscated PowerShell MSI Install via WindowsInstaller COM
- Obfuscated PowerShell OneLiner Execution
- Potential Data Exfiltration Activity Via CommandLine Tools
- Potential DLL File Download Via PowerShell Invoke-WebRequest
- Potential Encoded PowerShell Patterns In CommandLine
- Potential Persistence Via Powershell Search Order Hijacking - Task
- Potential PowerShell Command Line Obfuscation
- Potential PowerShell Downgrade Attack
- Potential PowerShell Obfuscation Using Alias Cmdlets
- Potential PowerShell Obfuscation Using Character Join
- Potential PowerShell Obfuscation Via Reversed Commands
- Potential PowerShell Obfuscation Via WCHAR/CHAR
- Potential Powershell ReverseShell Connection
- Potential Remote PowerShell Session Initiated
- Potential Suspicious PowerShell Keywords
- Potential WinAPI Calls Via PowerShell Scripts
- Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell
- Potentially Suspicious Command Executed Via Run Dialog Box - Registry
- Potentially Suspicious WebDAV LNK Execution
- PowerShell ADRecon Execution
- PowerShell Base64 Encoded FromBase64String Cmdlet
- PowerShell Base64 Encoded IEX Cmdlet
- PowerShell Base64 Encoded Invoke Keyword
- PowerShell Base64 Encoded Reflective Assembly Load
- PowerShell Base64 Encoded WMI Classes
- PowerShell Called from an Executable Version Mismatch
- PowerShell Core DLL Loaded By Non PowerShell Process
- PowerShell Create Local User
- PowerShell Credential Prompt
- PowerShell Downgrade Attack - PowerShell
- PowerShell Download Pattern
- Powershell Executed From Headless ConHost Process
- Powershell Inline Execution From A File
- PowerShell MSI Install via WindowsInstaller COM From Remote Location
- Powershell MsXml COM Object
- PowerShell PSAttack
- PowerShell Remote Session Creation
- PowerShell Script Run in AppData
- PowerShell ShellCode
- PowerShell Web Access Installation - PsScript
- Powershell XML Execute Command
- PowerView PowerShell Cmdlets - ScriptBlock
- PSAsyncShell - Asynchronous TCP Reverse Shell
- Remote LSASS Process Access Through Windows Remote Management
- Remote PowerShell Session (PS Classic)
- Remote PowerShell Session (PS Module)
- Remote PowerShell Session Host Process (WinRM)
- Remote PowerShell Sessions Network Connections (WinRM)
- Remote Thread Creation Via PowerShell In Uncommon Target
- Renamed Powershell Under Powershell Channel
- Scheduled Task Executing Encoded Payload from Registry
- Scheduled Task Executing Payload from Registry
- Silence.EDA Detection
- SQL Client Tools PowerShell Session Detection
- Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call
- Suspicious Encoded PowerShell Command Line
- Suspicious Execution of Powershell with Base64
- Suspicious File Execution From Internet Hosted WebDav Share
- Suspicious HH.EXE Execution
- Suspicious Interactive PowerShell as SYSTEM
- Suspicious PowerShell Download
- Suspicious PowerShell Download - PoshModule
- Suspicious PowerShell Download - Powershell Script
- Suspicious PowerShell Download and Execute Pattern
- Suspicious PowerShell Encoded Command Patterns
- Suspicious PowerShell IEX Execution Patterns
- Suspicious PowerShell Invocation From Script Engines
- Suspicious PowerShell Invocations - Generic
- Suspicious PowerShell Invocations - Generic - PowerShell Module
- Suspicious PowerShell Invocations - Specific
- Suspicious PowerShell Invocations - Specific - PowerShell Module
- Suspicious PowerShell Parameter Substring
- Suspicious PowerShell Parent Process
- Suspicious Schtasks Execution AppData Folder
- Suspicious WSMAN Provider Image Loads
- Suspicious XOR Encoded PowerShell Command
- Usage Of Web Request Commands And Cmdlets
- Usage Of Web Request Commands And Cmdlets - ScriptBlock
- Windows Shell/Scripting Processes Spawning Suspicious Programs
- WMImplant Hack Tool
Elastic 12 rules
- Dynamic IEX Reconstruction via Method String Access
- Potential Dynamic IEX Reconstruction via Environment Variables
- Potential PowerShell Obfuscation via Backtick-Escaped Variable Expansion
- Potential PowerShell Obfuscation via Character Array Reconstruction
- Potential PowerShell Obfuscation via Concatenated Dynamic Command Invocation
- Potential PowerShell Obfuscation via High Numeric Character Proportion
- Potential PowerShell Obfuscation via Invalid Escape Sequences
- Potential PowerShell Obfuscation via Reverse Keywords
- Potential PowerShell Obfuscation via Special Character Overuse
- Potential PowerShell Obfuscation via String Concatenation
- Potential PowerShell Obfuscation via String Reordering
- PowerShell Obfuscation via Negative Index String Reversal
Splunk 40 rules
- Detect Certify With PowerShell Script Block Logging
- Detect Empire with PowerShell Script Block Logging
- Detect Mimikatz With PowerShell Script Block Logging
- Exchange PowerShell Module Usage
- Get-ForestTrust with PowerShell Script Block
- GetLocalUser with PowerShell Script Block
- GetWmiObject User Account with PowerShell Script Block
- Malicious PowerShell Process With Obfuscation Techniques
- PowerShell 4104 Hunting
- Powershell COM Hijacking InprocServer32 Modification
- Powershell Creating Thread Mutex
- PowerShell Domain Enumeration
- PowerShell Enable PowerShell Remoting
- Powershell Execute COM Object
- Powershell Fileless Process Injection via GetProcAddress
- Powershell Fileless Script Contains Base64 Encoded Content
- Powershell Load Module in Meterpreter
- PowerShell Loading DotNET into Memory via Reflection
- Powershell Processing Stream Of Data
- PowerShell Script Block With URL Chain
- PowerShell Start or Stop Service
- Powershell Using memory As Backing Store
- PowerShell WebRequest Using Memory Stream
- Recon Using WMI Class
- Set Default PowerShell Execution Policy To Unrestricted or Bypass
- Unloading AMSI via Reflection
- Windows Account Access Removal via Logoff Exec
- Windows Enable PowerShell Web Access
- Windows Explorer LNK Exploit Process Launch With Padding
- Windows Explorer.exe Spawning PowerShell or Cmd
- Windows Powershell Cryptography Namespace
- Windows PowerShell Get CIMInstance Remote Computer
- Windows Powershell Import Applocker Policy
- Windows PowerShell Invoke-RestMethod IP Information Collection
- Windows PowerShell Invoke-Sqlcmd Execution
- Windows Powershell Logoff User via Quser
- Windows PowerShell MSIX Package Installation
- Windows PowerShell ScheduleTask
- Windows PowerShell Script Block With Malicious String
- Windows PowerShell WMI Win32 ScheduledJob