Detects loading of essential DLLs used by PowerShell, but not by the process powershell.exe. Detects behaviour similar to meterpreter's "load powershell" extension.

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

Detects Obfuscated use of Clip.exe to execute PowerShell

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Detects Obfuscated use of stdin to execute PowerShell

Detects Obfuscated use of Environment Variables to execute PowerShell

Detects Obfuscated Powershell via VAR++ LAUNCHER

Detects Obfuscated Powershell via Stdin in Scripts

Detects Obfuscated Powershell via use Clip.exe in Scripts

Detects Obfuscated Powershell via use MSHTA in Scripts

Detects Obfuscated Powershell via use Rundll32 in Scripts

Detects Commandlet names from well-known PowerShell exploitation frameworks

Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Detects remote PowerShell sessions

Detects suspicious PowerShell download command

Detects suspicious PowerShell invocation command parameters

Detects suspicious PowerShell invocation command parameters

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

Detects the creation of a remote thread from a Powershell process to another process

Detects the creation of a remote thread from a Powershell process in a rundll32 process

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Detects Commandlet names from well-known PowerShell exploitation frameworks

Detects Commandlet names from well-known PowerShell exploitation frameworks

Detects the creation of known offensive powershell scripts used for exploitation

Detects Commandlet names from PowerView of PowerSploit exploitation framework.

Detects Obfuscated use of Clip.exe to execute PowerShell

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Detects Obfuscated use of stdin to execute PowerShell

Detects Obfuscated use of Environment Variables to execute PowerShell

Detects Obfuscated Powershell via VAR++ LAUNCHER

Detects Obfuscated Powershell via Stdin in Scripts

Detects Obfuscated Powershell via use Clip.exe in Scripts

Detects Obfuscated Powershell via use MSHTA in Scripts

Detects Obfuscated Powershell via use Rundll32 in Scripts

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Detects default file names outputted by the BloodHound collection tool SharpHound

Detects the PowerShell command lines with special characters

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Detects usage of a base64 encoded "IEX" cmdlet in a process command line