Powershell.exe

Commands

1. ExecuteUser T1059.001

   Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires

   powershell.exe -ep bypass -file c:\path\to\a\script.ps1

   Set the execution policy to bypass and execute a PowerShell script without warning

   os: Windows 7 and up

2. ExecuteUser T1059.001

   Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires

   powershell.exe -ep bypass -command "Invoke-AllTheThings..."

   Set the execution policy to bypass and execute a PowerShell command

   os: Windows 7 and up

3. ExecuteUser T1059.001

   Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires

   powershell.exe -ep bypass -ec IgBXAGUAIAA8ADMAIABMAE8ATABCAEEAUwAiAA==

   Set the execution policy to bypass and execute a very malicious PowerShell encoded command

   os: Windows 7 and up

Detection

• Sigma https://github.com/SigmaHQ/sigma/tree/71ae004b32bb3c7fb04714f8a051fc8e5edda68c/rules/windows/powershell

Resources

• https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_exe?view=powershell-5.1
• https://attack.mitre.org/techniques/T1059/001/