Malicious PowerShell Scripts - PoshModule

SigmaHQ Detections@sigmaHQ

•updated Jul 7, 2025•0•21

Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.