Suspicious PowerShell/WMI Command Execution from Office or Explorer

Ankit Mehta@Secvyn

•updated Mar 31, 2026•6•0•95

Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.