PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.(Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a co...
BY SOURCE
PROCEDURES (122)
Auto-extracted: 24 detections for obfuscat
Auto-extracted: 19 detections for obfuscat
Auto-extracted: 16 detections for powershell
Auto-extracted: 13 detections for powershell
Auto-extracted: 13 detections for obfuscat
Auto-extracted: 10 detections for amsi
Auto-extracted: 9 detections for suspicious
Auto-extracted: 8 detections for process creation monitoring
Auto-extracted: 7 detections for script execution monitoring
Auto-extracted: 7 detections for powershell
Auto-extracted: 7 detections for base64
Auto-extracted: 6 detections for download
Auto-extracted: 5 detections for base64
Auto-extracted: 5 detections for child process
Auto-extracted: 5 detections for suspicious
Auto-extracted: 5 detections for exfiltrat
Auto-extracted: 4 detections for remote
Auto-extracted: 4 detections for suspicious
Auto-extracted: 4 detections for script block
Auto-extracted: 4 detections for service
Auto-extracted: 4 detections for lateral
Auto-extracted: 4 detections for credential
Auto-extracted: 3 detections for unusual
Auto-extracted: 3 detections for general monitoring
Auto-extracted: 3 detections for lateral
Auto-extracted: 3 detections for ransomware
Auto-extracted: 3 detections for registry
Auto-extracted: 3 detections for bypass
Auto-extracted: 3 detections for remote
Auto-extracted: 3 detections for child process
Auto-extracted: 3 detections for service
Auto-extracted: 3 detections for token
Auto-extracted: 3 detections for persist
Auto-extracted: 3 detections for email
Auto-extracted: 3 detections for remote
Auto-extracted: 2 detections for suspicious
Auto-extracted: 2 detections for bypass
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for inject
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for registry monitoring
Auto-extracted: 2 detections for parent process
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for powershell
Auto-extracted: 2 detections for exfiltrat
Auto-extracted: 2 detections for phish
Auto-extracted: 2 detections for evasion
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for wmi
Auto-extracted: 2 detections for api
Auto-extracted: 2 detections for kerbero
Auto-extracted: 2 detections for reflection
Auto-extracted: 2 detections for ransomware
Auto-extracted: 2 detections for download
Auto-extracted: 2 detections for registry
Auto-extracted: 2 detections for scheduled task
Auto-extracted: 2 detections for service
Auto-extracted: 2 detections for encoded command
Auto-extracted: 2 detections for remote
Auto-extracted: 2 detections for http
Auto-extracted: 2 detections for bypass
Auto-extracted: 1 detections for command line monitoring
Auto-extracted: 1 detections for amsi
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for encoded command
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for privilege
Auto-extracted: 1 detections for ntds
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for email
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for token
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for file monitoring
Auto-extracted: 1 detections for api
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for tamper
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for ransomware
Auto-extracted: 1 detections for event log
Auto-extracted: 1 detections for dump
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for evasion
Auto-extracted: 1 detections for anomal
Auto-extracted: 1 detections for lsass
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for azure
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for c2
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for startup
Auto-extracted: 1 detections for ntds
Auto-extracted: 1 detections for ntds
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for command and control
Auto-extracted: 1 detections for dns
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for scheduled task
Auto-extracted: 1 detections for wmi
Auto-extracted: 1 detections for reflection
Auto-extracted: 1 detections for parent process
Auto-extracted: 1 detections for mimikatz
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for startup