PowerShell Script Execution from Alternate Data Stream

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•17

Detects PowerShell script execution from an Alternate Data Stream (ADS). This rule identifies instances where 'powershell.exe' or 'pwsh.exe' is launched, and its command line arguments include 'Get-Content' and '-Stream'. This combination indicates that PowerShell is being used to read and potentially execute content hidden within an Alternate Data Stream, a common technique for defense evasion.