Malicious PowerShell Commandlets from Exploitation Frameworks

SigmaHQ Detections@sigmaHQ

•updated Jul 7, 2025•2•0•60

Detects the execution of PowerShell commandlets commonly associated with well-known PowerShell exploitation frameworks and tools. This rule identifies specific commandlet names within process command lines, indicating potential malicious activity such as credential dumping, reconnaissance, privilege escalation, persistence, and lateral movement.