powershell_classic

Potential RemoteFXvGPUDisablement.EXE Abuse

Apr 28, 2026 · attack.stealth attack.t1218 ·

Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.

PowerShell Called from an Executable Version Mismatch

Apr 28, 2026 · attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell called from an executable by the version mismatch method

PowerShell Downgrade Attack - PowerShell

Apr 28, 2026 · attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Renamed Powershell Under Powershell Channel

Apr 28, 2026 · attack.execution attack.stealth attack.t1059.001 attack.t1036.003 ·

Share on:

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

Tamper Windows Defender - PSClassic

Apr 28, 2026 · attack.defense-impairment attack.t1685 ·

Share on:

Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

PowerShell Download Via Net.WebClient - PowerShell Classic

Apr 27, 2026 · attack.execution attack.command-and-control attack.t1059.001 attack.t1105 ·

Share on:

Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads.

Netcat The Powershell Version

Apr 27, 2026 · attack.command-and-control attack.execution attack.t1095 attack.t1059.001 ·

Share on:

Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Suspicious Non PowerShell WSMAN COM Provider

Oct 23, 2025 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.003 ·

Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Nslookup PowerShell Download Cradle

Mar 4, 2025 · attack.execution attack.t1059.001 ·

Share on:

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

Delete Volume Shadow Copies Via WMI With PowerShell

Aug 12, 2024 · attack.impact attack.t1490 ·

Share on:

Shadow Copies deletion using operating systems utilities via PowerShell

Remote PowerShell Session (PS Classic)

Aug 12, 2024 · attack.execution attack.t1059.001 attack.lateral-movement attack.t1021.006 ·

Share on:

Detects remote PowerShell sessions

Use Get-NetTCPConnection

Aug 12, 2024 · attack.discovery attack.t1049 ·

Share on:

Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Zip A Folder With PowerShell For Staging In Temp - PowerShell

Aug 12, 2024 · attack.collection attack.t1074.001 ·

Share on:

Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.