Potential PowerShell Obfuscation Using Alias Cmdlets

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•13

This rule detects the use of 'Set-Alias' or 'New-Alias' cmdlets in PowerShell script block logs. Adversaries often use these cmdlets to create aliases for legitimate or malicious commands, thereby obfuscating their activities and making detection more difficult. The rule includes a filter for common, legitimate CIM session-related aliases to reduce false positives.