CmdID

CmdID / PowerShell / Cmdlets / Invoke

Invoke-Expression

Runs commands or expressions on the local computer. PowerShell reference

From the PowerShell reference 1 parameter Alias iex 5 Sigma rules look for it

Opens CmdID with your command, read as PowerShell. It is read in your browser and sent nowhere.

What it does

from the PowerShell reference, CC BY 4.0

Runs commands or expressions on the local computer. The Invoke-Expression cmdlet evaluates or runs a specified string as a command and returns the results of the expression or command. Without Invoke-Expression, a string submitted at the command line is returned (echoed) unchanged. Expressions are evaluated and run in the current scope. For more information, see about_Scopes. CAUTION: Take reasonable precautions when using the Invoke-Expression cmdlet in scripts. When using Invoke-Expression to run a command that the user enters, verify that the command is safe to run before running it. In general, it is best to design your script with predefined input options, rather than allowing freeform input.

Invoke-Expression [-Command] <String> [<CommonParameters>]

Evaluate an expression

$Command = "Get-Process" $CommandIdentify

Run a script on the local computer

Invoke-Expression -Command "C:\ps-test\testscript.ps1" "C:\ps-test\testscript.ps1" | Invoke-ExpressionIdentify

Run a command in a variable

$Command = 'Get-Process | where {$_.CPU -gt 1000}' Invoke-Expression $CommandIdentify

Get and run a cmdlet Help example

$Cmdlet_name = "Get-ComputerInfo" $Example_number = 1 $Example_code = (Get-Help $Cmdlet_name).examples.example[($Example_number-1)].code Invoke-Expression $Example_codeIdentify

Its page in the reference: Invoke-Expression.

Parameters

1 in the PowerShell reference
-CommandSpecifies the command or expression to run. Type the command or expression or enter a variable that contains the command or expression. The Command parameter is required.

What looks for it

Sigma process creation rules that name Invoke-Expression
criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)
highPotential PowerShell Execution Via DLLMarkus Neis, Nasreddine Bencherchali (Nextron Systems)
highPowerShell Download and Execution CradlesFlorian Roth (Nextron Systems)