<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-malicious-powershell-execution
description: >-
  Identify malicious PowerShell usage including encoded commands, AMSI bypasses, download cradles, and reflective loading.
domain: cybersecurity
subdomain: endpoint-security
tags:
  - powershell
  - detection
  - amsi
  - script-block-logging
  - living-off-the-land
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1059.001"]
---

# Detecting Malicious PowerShell Execution

## Overview

PowerShell is the most commonly abused living-off-the-land binary on Windows.
Attackers use it for download cradles, credential theft, lateral movement, and
data exfiltration. Effective detection requires proper logging configuration
combined with behavioral detection rules.

## Prerequisites

| Requirement | Install |
|---|---|
| PowerShell 5.1+ / 7+ | Script Block Logging support |
| Windows Event Forwarding | Centralized log collection |
| SIEM platform | Detection rule deployment |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Logging Configuration

| Log Type | GPO Setting | Event ID |
|---|---|---|
| Script Block Logging | Turn on Script Block Logging | 4104 |
| Module Logging | Turn on Module Logging | 4103 |
| Transcription | Turn on Transcription | N/A (file) |
| AMSI | Built-in (Windows 10+) | 1116 (Defender) |

### Malicious Patterns

- **Encoded commands** — `-EncodedCommand`, `-enc`, base64 payloads
- **Download cradles** — `IEX(New-Object Net.WebClient).DownloadString()`
- **AMSI bypass** — `[Ref].Assembly.GetType('...AmsiUtils')`
- **Reflective loading** — `[System.Reflection.Assembly]::Load()`
- **Obfuscation** — String concatenation, tick marks, variable substitution

### Detection Layers

1. **Command-line arguments** — Process creation with suspicious flags
2. **Script Block content** — Deobfuscated code in EID 4104
3. **AMSI telemetry** — Content scanned at runtime
4. **Network connections** — PowerShell making outbound HTTP/HTTPS
5. **Module loads** — Suspicious .NET assemblies

## Workflow

1. **Enable logging** — configure Script Block, Module, and Transcription logging via GPO
2. **Forward events** — collect EID 4103, 4104 via Windows Event Forwarding
3. **Build detection rules** — create Sigma/SIEM rules for malicious patterns
4. **Baseline legitimate usage** — document admin scripts and automation
5. **Tune false positives** — whitelist known-good scripts by hash or path
6. **Monitor AMSI events** — correlate Defender EID 1116 with PowerShell activity
7. **Respond to alerts** — investigate, contain, and remediate confirmed threats

## Quick Reference

```bash
# Run the agent
node scripts/agent.js analyze --target <scope>
node scripts/agent.js report --target <scope>
```

## Detection

```yaml
title: Malicious Powershell Execution Detection
id: 69e133ca-bba1-4625-9197-48cbb29db41d
status: experimental
description: Detects suspicious activity related to detecting malicious powershell execution techniques in endpoint security context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*detecting*malicious*"
  condition: selection
level: medium
tags:
  - attack.t1059.001
  - attack.execution
falsepositives:
  - Endpoint management software performing routine maintenance tasks
```

## Verification

| Check | Method |
|---|---|
| Logging enabled | EID 4104 events generated for test script execution |
| Events forwarded | PowerShell events visible in SIEM within 5 minutes |
| Rules deployed | Detection rules trigger on encoded command test |
| Baseline documented | Known admin scripts cataloged with hashes |
| AMSI working | AMSI test string triggers Defender detection |

## References

- [MITRE ATT&CK — T1059.001](https://attack.mitre.org/techniques/T1059/001/)
- [Microsoft — PowerShell Logging](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows)
- [SANS — PowerShell Logging](https://www.sans.org/blog/)
- [Revoke-Obfuscation](https://github.com/danielbohannon/Revoke-Obfuscation)
