powershell

Windows PowerShell is a task-based command-line shell and scripting language designed especially for system administration. Windows commands reference

On Windows 170 Sigma rules name it File powershell.exe

Windows

from the Windows commands reference, CC BY 4.0

Windows PowerShell is a task-based command-line shell and scripting language designed especially for system administration. Built on the .NET Framework, Windows PowerShell helps IT professionals and power users control and automate the administration of the Windows operating system and applications that run on Windows.

Several platforms

from tldr-pages, CC BY 4.0

This command may be mistaken as the cross-platform version of PowerShell (formerly known as PowerShell Core), which uses pwsh instead of powershell. The original powershell command in Windows is still available to use the legacy Windows version of PowerShell (version 5.1 and below).

Windows

from tldr-pages, CC BY 4.0

Command-line shell and scripting language designed especially for system administration. This command refers to PowerShell version 5.1 and below (also known as the legacy Windows PowerShell). To use the newer, cross-platform version of PowerShell (also known as PowerShell Core), use pwsh instead of powershell.

Start an interactive shell session

powershellIdentify

Start an interactive shell session without loading startup configs

powershell -NoProfileIdentify

-NoProfileDoesn't load the PowerShell profile. about_PowerShell_exe

Execute specific commands

powershell -Command "echo 'powershell is executed'"Identify

-CommandThe value of Command can be -, a script block, or a string. about_PowerShell_exe

Execute a specific script

powershell -File path\to\script.ps1Identify

-FileThe value of File can be - or a filepath and optional parameters. about_PowerShell_exe

Start a session with a specific version of PowerShell

powershell -Version versionIdentify

-VersionStarts the specified version of PowerShell. about_PowerShell_exe

Prevent a shell from exit after running startup commands

powershell -NoExitIdentify

-NoExitDoesn't exit after running startup commands. about_PowerShell_exe

Describe the format of data sent to PowerShell

powershell -InputFormat TextIdentify

-InputFormatDescribes the format of data sent to PowerShell. about_PowerShell_exe

Determine how an output from PowerShell is formatted

powershell -OutputFormat TextIdentify

-OutputFormatDetermines how output from PowerShell is formatted. about_PowerShell_exe

What detects it

Sigma process creation rules that name powershell

criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

criticalPotential CVE-2021-41379 Exploitation AttemptFlorian Roth (Nextron Systems)

criticalSticky Key Like Backdoor ExecutionFlorian Roth (Nextron Systems), @twjackomo, Jonhnathan Ribeiro, oscd.community

criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)

highAADInternals PowerShell Cmdlets Execution - ProccessCreationAustin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

highAbused Debug Privilege by Arbitrary Parent ProcessesSemanur Guneysu @semanurtg, oscd.community

highAxios NPM Compromise Indicators - WindowsSwachchhanda Shrawan Poudel (Nextron Systems)

highCVE-2023-38331 Exploitation Attempt - Suspicious WinRAR Child ProcessNasreddine Bencherchali (Nextron Systems), Andreas Braathen (mnemonic.io)

highDisable Windows Defender AV Security Monitoringok @securonix invrep-de, oscd.community, frack113

highETW Trace Evasion Activity@neu5ron, Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community

highEmail Exifiltration Via PowershellNasreddine Bencherchali (Nextron Systems), Azure-Sentinel (idea)

highEmotet Loader Execution Via .LNK File@kostastsale

highExchange PowerShell Snap-Ins UsageFPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)

highExecution of Powershell Script in Public FolderMax Altgelt (Nextron Systems)

highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child ProcessHuntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)

highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)

highFakeUpdates/SocGholish Activity@kostastsale

highHTML Help HH.EXE Suspicious Child ProcessMaxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)

highHackTool - CrackMapExec PowerShell ObfuscationThomas Patzke

highHypervisor-protected Code Integrity (HVCI) Related Registry Tampering Via CommandLineSwachchhanda Shrawan Poudel (Nextron Systems)

highLOL-Binary Copied From System DirectoryNasreddine Bencherchali (Nextron Systems)

highMMC Spawning Windows ShellKarneades, Swisscom CSIRT

highMalicious Base64 Encoded PowerShell Keywords in Command LinesJohn Lambert (rule)

highNet WebClient Casing AnomaliesFlorian Roth (Nextron Systems)

highObfuscated PowerShell MSI Install via WindowsInstaller COMMeroujan Antonyan (vx3r)

highObfuscated PowerShell OneLiner Execution@Kostastsale, TheDFIRReport

highOneNote.EXE Execution of Malicious Embedded Scripts@kostastsale

highPaperCut MF/NG Potential ExploitationNasreddine Bencherchali (Nextron Systems), Huntress DE&TH Team (idea)

highPotential CVE-2021-44228 Exploitation Attempt - VMware Horizon@kostastsale

And 140 more rules that name powershell.