PowerShell Execution from Browser with Suspicious Arguments

Jason Nelson@Jason

•updated Jul 18, 2025•28•5•150

This rule detects the execution of PowerShell with suspicious command-line arguments (such as base64 encoded strings, Invoke-Expression, or encoded commands) when the parent process is a web browser. This behavior is often indicative of drive-by downloads, malicious advertisements, or exploitation of browser vulnerabilities leading to the execution of malicious PowerShell scripts.