Powershell.exe is a a task-based command-line shell built on .NET. Located at: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe; C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.
powershellpowershellSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Set the execution policy to bypass and execute a PowerShell script without warning (Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires)
powershell.exe -ep bypass -file c:\path\to\a\script.ps1Set the execution policy to bypass and execute a PowerShell command (Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires)
powershell.exe -ep bypass -command "Invoke-AllTheThings..."Set the execution policy to bypass and execute a very malicious PowerShell encoded command (Execute PowerShell cmdlets, .NET code, and just about anything else your heart desires)
powershell.exe -ep bypass -ec IgBXAGUAIAA8ADMAIABMAE8ATABCAEEAUwAiAA==| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/tree/71ae004b32bb3c7fb04714f8a051fc8e5edda68c/rules/windows/powershell |
powershell is a Windows LOLBin. Powershell.exe is a a task-based command-line shell built on .NET. Located at: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe; C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe.