Import New Module Via PowerShell CommandLine

SigmaHQ Detections@sigmaHQ

•updated Oct 1, 2024•0•22

Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.