Suspicious PowerShell Commands in Registry

Jorden Smith@Jorden

•updated Feb 10, 2026•2•0•20

This rule detects suspicious PowerShell commands that are written to the Windows registry. It specifically looks for registry events where the 'Details' field contains keywords indicative of PowerShell execution ('powershell', 'pwsh') combined with suspicious command elements. These suspicious elements include obfuscation flags or download capabilities such as 'iex', 'Invoke-Expression', 'DownloadString', 'DownloadFile', 'Net.WebClient', 'FromBase64String', '-w hidden', '-windowstyle hidden', '-ep bypass', '-executionpolicy bypass', '-enc ', and '-encodedcommand'. The presence of such commands in the registry may indicate a persistence mechanism, a configuration backdoor, or automated malware execution.