PowerShell Command Line Execution by User
This rule detects PowerShell command line execution by user accounts. It specifically looks for `PowerShellCommand` events where the `InitiatingProcessFileName` is `powershell.exe` and the `InitiatingProcessAccountName` is not 'system'. It also ensures that both `ProcessCommandLine` and `InitiatingProcessCommandLine` are not empty. This helps monitor PowerShell usage across endpoints, detect suspicious or unauthorized script execution, and investigate potential lateral movement or remote access.
Microsoft Sentinel (KQL)
