CmdID

CmdID / Files

powershell.exe

Windows PowerShell file version info

Program on Windows 14 known copies with hashes 227 Sigma rules name it Command powershell

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real powershell.exe?

file version info and known copies
Installed inC:\Windows\system32\WindowsPowerShell\v1.0\
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows PowerShell

14 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

88e1993beb7b2d9c3a9c3a026dc8d0170159afd3e574825c23a34b917ca61122

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

c7d4e119149a7150b7101a4bd9fffbf659fba76d058f7bf6cc73c99fb36e8221

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

9af8a2d9ca5d904b9ca6696016b2a794ef7eb97693ccca22df2a367305d31b88

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

fcc434cc413e969de19d329ca4e15ca567da5daa1f7e265d96eaf6e3d9d8b2cb

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

7762a4766bc394b4cb2d658144b207183ff23b3139181cd74e615db63e6e57d6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

908b64b1971a979c7e3e8ce4621945cba84854cb98d76367b791a6e22b5f6d53

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

1ee3d7c80d075d64f97d04d036e558043f2f6bc959c87cd5b0a6d53b96b96a0f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

8133502266008b77de7921451e1210b0ef3f0ed2db7d8d3ee0c3350d856fa6fa

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe · signed by Microsoft Windows

ba4038fd20e474c047be8aad5bfacdb1bfc1ddbe12f803f473b7918d8d819436

6.3.9600.17396 (winblue_r4.141007-2030) · C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe · not signed

0bbf1952ee724d29f04d9ea52cae9c8c781791d57ed127ae7b618704c3395a79

6.3.9600.17396 (winblue_r4.141007-2030) · C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe · not signed

840e1f9dc5a29bebf01626822d7390251e9cf05bb3560ba7b68bdb8a41cf08e3

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name powershell.exe
criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
criticalPotential CVE-2021-41379 Exploitation AttemptFlorian Roth (Nextron Systems)
criticalQakbot Rundll32 Exports ExecutionX__Junior (Nextron Systems)
criticalQakbot Rundll32 Fake DLL Extension ExecutionX__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highAADInternals PowerShell Cmdlets Execution - ProccessCreationAustin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community
highAxios NPM Compromise Indicators - WindowsSwachchhanda Shrawan Poudel (Nextron Systems)
highCVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child ProcessNasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)
highChromeLoader Malware Execution@kostastsale
highCsc.EXE Execution Form Potentially Suspicious ParentFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems)
highDisable Windows Defender AV Security Monitoringok @securonix invrep-de, oscd.community, frack113
highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community
highEmail Exifiltration Via PowershellNasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea)
highEmotet Loader Execution Via .LNK File@kostastsale
highExchange PowerShell Snap-Ins UsageFPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)
highExecution of Powershell Script in Public FolderMax Altgelt (Nextron Systems)
highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child ProcessHuntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)
highFakeUpdates/SocGholish Activity@kostastsale
highFile Explorer Folder Opened Using Explorer Folder Shortcut Via Shell@Kostastsale
highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)
highHackTool - CrackMapExec Execution PatternsThomas Patzke
highHackTool - CrackMapExec PowerShell ObfuscationThomas Patzke
highHackTool - Default PowerSploit/Empire Scheduled Task CreationMarkus Neis, @Karneades
highHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)
highLOL-Binary Copied From System DirectoryNasreddine Bencherchali (Nextron Systems)
highMMC Spawning Windows ShellKarneades, Swisscom CSIRT

And 166 more process creation rules that name powershell.exe.

Sigma names powershell.exe in 227 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.