powershell_ise

On Windows 38 Sigma rules name it File powershell_ise.exe

Windows

from the Windows commands reference, CC BY 4.0

Windows PowerShell Integrated Scripting Environment (ISE) is a graphical host application that enables you to read, write, run, debug, and test scripts and modules in a graphic-assisted environment. Key features such as IntelliSense, Show-Command, snippets, tab completion, syntax-coloring, visual debugging, and context-sensitive Help provide a rich scripting experience.

What detects it

Sigma process creation rules that name powershell_ise

criticalMint Sandstorm - AsperaFaspex Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

criticalMint Sandstorm - ManageEngine Suspicious Process ExecutionNasreddine Bencherchali (Nextron Systems), MSTIC (idea)

highAADInternals PowerShell Cmdlets Execution - ProccessCreationAustin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)

highExploitation Activity of CVE-2025-59287 - WSUS Suspicious Child ProcessHuntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)

highObfuscated PowerShell MSI Install via WindowsInstaller COMMeroujan Antonyan (vx3r)

highPotential CVE-2023-36874 Exploitation - Fake Wermgr ExecutionNasreddine Bencherchali (Nextron Systems)

highPotential CommandLine Obfuscation Using Unicode Characters From Suspicious Imagefrack113, Florian Roth (Nextron Systems), Josh Nickels

highPotential Data Exfiltration Activity Via CommandLine ToolsNasreddine Bencherchali (Nextron Systems)

highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113

highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar

highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

highPotentially Suspicious Child Processes Spawned by ConHostSwachchhanda Shrawan Poudel (Nextron Systems)

highRedSun - Conhost.exe Spawned by TieringEngineService.exeSwachchhanda Shrawan Poudel (Nextron Systems), @unresolvedhost

highSecurity Event Logging Disabled via MiniNt Registry Key - ProcessSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious BitLocker Access Agent Update Utility Executionandrewdanis, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)

highSuspicious Eventlog Clearing or Configuration Change ActivityEcco, Daniil Yugoslavskiy, oscd.community, D3F7A5105, Swachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Invoke-WebRequest ExecutionNasreddine Bencherchali (Nextron Systems)

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Uninstall of Windows Defender Feature via PowerShellyxinmiracle

highSuspicious Velociraptor Child ProcessSwachchhanda Shrawan Poudel (Nextron Systems)

highSuspicious Windows Service TamperingNasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)

highSystem File Execution Location AnomalyFlorian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)

highWindows Defender Context Menu RemovedMatt Anderson (Huntress)

mediumChange PowerShell Policies to an Insecure Levelfrack113

mediumCopy From Or To Admin Share Or Sysvol FolderFlorian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali

mediumElevated System Shell SpawnedNasreddine Bencherchali (Nextron Systems), frack113

mediumElevated System Shell Spawned From Uncommon Parent Locationfrack113, Tim Shelton (update fp)

mediumIIS WebServer Log Deletion via CommandLine UtilitiesSwachchhanda Shrawan Poudel (Nextron Systems)

mediumNew DMSA Service Account Created in Specific OUsSwachchhanda Shrawan Poudel (Nextron Systems)

And 8 more rules that name powershell_ise.