Malicious PowerShell Commandlets - ScriptBlock Detection

SigmaHQ Detections@sigmaHQ

•updated Jul 7, 2025•1•0•29

Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks, red-teaming tools, and malware. This rule identifies a wide range of offensive PowerShell functions used for reconnaissance, credential dumping, privilege escalation, persistence, and data exfiltration.