Executive Summary
Recent findings highlight a critical visibility gap in standard endpoint monitoring where investigators see PowerShell execution commands but cannot inspect the contents of transient or deleted scripts. This technique is frequently used in post-exploitation scenarios involving tools like PowerSploit and Mimikatz to perform credential theft and lateral movement while evading detection based solely on process command lines.
Technical analysis reveals that the 'PowerShellCommand' action type within the Microsoft Defender XDR DeviceEvents table captures specific commands executed within scripts, even when the original .ps1 file is unavailable. This telemetry allows for the detection of high-risk activities such as reflective PE injection, memory manipulation, and automated credential harvesting.
Failure to monitor these specific sub-command events can lead to undetected initial footholds and lateral movement. Organizations using Defender for Endpoint should immediately integrate KQL queries targeting internal script commands to identify suspicious patterns that bypass basic process-level alerting.