Malicious PowerShell Commandlets - PoshModule

SigmaHQ Detections@sigmaHQ

•updated Jul 7, 2025•0•39

Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.