PowerShell Activity After Malicious Email Receipt

Subash Ghimire@iamsubashg

•updated Aug 20, 2025•4•0•52

This rule detects PowerShell activity on user workstations within 30 minutes of receiving an email from a known malicious sender. It aims to identify potential post-compromise activity initiated by a successful phishing attempt.