PowerShell XML Document Command Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

This rule detects PowerShell script blocks that create an XML document object, load content into it, and then attempt to execute commands using common PowerShell execution cmdlets like 'IEX', 'Invoke-Expression', or 'Invoke-Command'. This combination is often used by adversaries to load and execute malicious code, potentially from an external source or obfuscated within an XML structure.