CmdID / Files

powershell_ise.exe

Windows PowerShell ISE file version info

Program on Windows 12 known copies with hashes 51 Sigma rules name it Command powershell_ise

Is it the real powershell_ise.exe?

file version info and known copies

Installed inC:\Windows\system32\WindowsPowerShell\v1.0\
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionWindows PowerShell ISE

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

5baf4a9dddd940aa7bdd653342681acd479fae63a949296703d770bdedd055b0

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

df54cbe8ad814ae09766f3cdb5c3bca9bd407621211daa23194e58533837d2e0

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

1172951d8b1aa4cf9d0ac9f72ae344c5896ce4286c790a1f0dff8a6f71a5772e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

92a89ae883ed67889c50fa7af84b1a94768c7a257daa263211616d745d8dbdc3

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

6cbcd7e7544c5878c07382499440c4878b5da4c8b2c64bc9d81f1a2686330b0f

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

72f9449a487f7e41f38f7a936d11b01cff73f7dc43d7a13e020cc50940c4ae84

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

77b4c0f9929073ce132223f3169349f3e7a626c392b7dbc1a39fa89265c2c6bf

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

cd65ae1ebb2b8ee7dea364729a14d3cf4221c0ea9156b55a84ead138f5c146e3

10.0.14393.103 (rs1_release_inmarket.160819-1924) · C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

9da2b642163f16f463053774b2b0ed04bbb40ba550463ef3471fdf94202bd69f

10.0.14393.103 (rs1_release_inmarket.160819-1924) · C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe · signed by Microsoft Windows

c2e227a3a9668d651c9f7af5b27c4fc198f4d043d951e6ec100bedc5497942f7

6.3.9600.17399 (winblue_r4.141010-1702) · C:\windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe · not signed

9f0aa70533741d0b9ca0d23bdf8c6b509844e9ec1776b442a9c0dcf2d99b00bb

6.3.9600.17399 (winblue_r4.141010-1702) · C:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe · not signed

aa300b32cbe3c2109ac25bfc50a3a08de43efba5889ded23ce20a828978ad616

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name powershell_ise.exe

criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

highAADInternals PowerShell Cmdlets Execution - ProccessCreationAustin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child ProcessHuntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)

highObfuscated PowerShell MSI Install via WindowsInstaller COMMeroujan Antonyan (vx3r)

highPotential CVE-2023-36874 Exploitation - Fake Wermgr ExecutionNasreddine Bencherchali (Nextron Systems)

highPotential CommandLine Obfuscation Using Unicode Characters From Suspicious Imagefrack113, Florian Roth (Nextron Systems), Josh Nickels

highPotential Data Exfiltration Activity Via CommandLine ToolsNasreddine Bencherchali (Nextron Systems)

highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113

highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar

highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems)

highRedSun - Conhost.exe Spawned by TieringEngineService.exeSwachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost

highSecurity Event Logging Disabled via MiniNt Registry Key - ProcessSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)

highSuspicious Eventlog Clearing or Configuration Change ActivityEcco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Invoke-WebRequest ExecutionNasreddine Bencherchali (Nextron Systems)

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Uninstall of Windows Defender Feature via PowerShellyxinmiracle

highSuspicious Use of CSharp Interactive ConsoleMichael R. (@nahamike01)

highSuspicious Velociraptor Child ProcessSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Windows Service TamperingNasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

highWindows Defender Context Menu RemovedMatt Anderson (Huntress)

mediumChange PowerShell Policies to an Insecure Levelfrack113

mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali

mediumElevated System Shell SpawnedNasreddine Bencherchali (Nextron Systems), frack113

mediumElevated System Shell Spawned From Uncommon Parent Locationfrack113, Tim Shelton (update fp)

mediumIIS WebServer Log Deletion via CommandLine UtilitiesSwachchhanda Shrawan Poudel (Nextron Systems)

And 12 more process creation rules that name powershell_ise.exe.

Sigma names powershell_ise.exe in 51 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.