T1059 Command and Scripting Interpreter

About this technique

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.

Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands. Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2. Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

Rule	Level	Log source	Technique
Bad Opsec Powershell Code Artifacts	critical	windows / ps_module	T1059.001
HackTool - Sliver C2 Implant Activity Pattern	critical	windows / process_creation	T1059
Linux Reverse Shell Indicator	critical	linux / network_connection	T1059.004
Silence.EDA Detection	critical	windows / ps_script	T1059.001
Abusable DLL Potential Sideloading From Suspicious Location	high	windows / image_load	T1059
Add Insecure Download Source To Winget	high	windows / process_creation	T1059
Adwind RAT / JRAT File Artifact	high	windows / file_event	T1059.005 T1059.007
Atlassian Confluence CVE-2022-26134	high	linux / process_creation	T1059
AWS EC2 Startup Shell Script Change	high	aws / NULL	T1059.001 T1059.003 T1059.004
AWS IAM S3Browser LoginProfile Creation	high	aws / NULL	T1059.009
AWS IAM S3Browser Templated S3 Bucket Policy Creation	high	aws / NULL	T1059.009
AWS IAM S3Browser User or AccessKey Creation	high	aws / NULL	T1059.009
Base64 Encoded PowerShell Command Detected	high	windows / process_creation	T1059.001
BloodHound Collection Files	high	windows / file_event	T1059.001
BPFDoor Abnormal Process ID or Lock File Accessed	high	linux / NULL	T1059
Capsh Shell Invocation - Linux	high	linux / process_creation	T1059
Cmd.EXE Missing Space Characters Execution Anomaly	high	windows / process_creation	T1059.001
Conhost.exe CommandLine Path Traversal	high	windows / process_creation	T1059.003
Csc.EXE Execution Form Potentially Suspicious Parent	high	windows / process_creation	T1059.005 T1059.007
Cscript/Wscript Uncommon Script Extension Execution	high	windows / process_creation	T1059.005 T1059.007
DNS Query by Finger Utility	high	windows / dns_query	T1059.003
DSInternals Suspicious PowerShell Cmdlets	high	windows / process_creation	T1059.001
DSInternals Suspicious PowerShell Cmdlets - ScriptBlock	high	windows / ps_script	T1059.001
Equation Group Indicators	high	linux / NULL	T1059.004
ESXi Admin Permission Assigned To Account Via ESXCLI	high	linux / process_creation	T1059.012
Exchange PowerShell Snap-Ins Usage	high	windows / process_creation	T1059.001
Execution of Powershell Script in Public Folder	high	windows / process_creation	T1059.001
HackTool - Bloodhound/Sharphound Execution	high	windows / process_creation	T1059.001
HackTool - CACTUSTORCH Remote Thread Creation	high	windows / create_remote_thread	T1059.005 T1059.007
HackTool - Covenant PowerShell Launcher	high	windows / process_creation	T1059.001
HackTool - CrackMapExec Execution	high	windows / process_creation	T1059.001 T1059.003
HackTool - CrackMapExec Execution Patterns	high	windows / process_creation	T1059.001 T1059.003
HackTool - CrackMapExec PowerShell Obfuscation	high	windows / process_creation	T1059.001
HackTool - Default PowerSploit/Empire Scheduled Task Creation	high	windows / process_creation	T1059.001
HackTool - Empire PowerShell Launch Parameters	high	windows / process_creation	T1059.001
HackTool - Koadic Execution	high	windows / process_creation	T1059.003 T1059.005 T1059.007
HackTool - NetExec File Indicators	high	windows / file_event	T1059.005
HackTool - RedMimicry Winnti Playbook Execution	high	windows / process_creation	T1059.003
HackTool - Stracciatella Execution	high	windows / process_creation	T1059
Hacktool Ruler	high	windows / NULL	T1059
HTML Help HH.EXE Suspicious Child Process	high	windows / process_creation	T1059.001 T1059.003 T1059.005 T1059.007
Inline Python Execution - Spawn Shell Via OS System Library	high	linux / process_creation	T1059
Installation of WSL Kali-Linux	high	windows / process_creation	T1059
Invoke-Obfuscation CLIP+ Launcher	high	windows / process_creation	T1059.001
Invoke-Obfuscation CLIP+ Launcher - PowerShell	high	windows / ps_script	T1059.001
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation CLIP+ Launcher - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation CLIP+ Launcher - System	high	windows / NULL	T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation	high	windows / process_creation	T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell	high	windows / ps_script	T1059.001
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation STDIN+ Launcher	high	windows / process_creation	T1059.001
Invoke-Obfuscation STDIN+ Launcher - Powershell	high	windows / ps_script	T1059.001
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation STDIN+ Launcher - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation STDIN+ Launcher - System	high	windows / NULL	T1059.001
Invoke-Obfuscation VAR+ Launcher	high	windows / process_creation	T1059.001
Invoke-Obfuscation VAR+ Launcher - PowerShell	high	windows / ps_script	T1059.001
Invoke-Obfuscation VAR+ Launcher - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation VAR+ Launcher - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation VAR+ Launcher - System	high	windows / NULL	T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION	high	windows / process_creation	T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell	high	windows / ps_script	T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Stdin	high	windows / process_creation	T1059.001
Invoke-Obfuscation Via Stdin - Powershell	high	windows / ps_script	T1059.001
Invoke-Obfuscation Via Stdin - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation Via Stdin - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Stdin - System	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Use Clip	high	windows / process_creation	T1059.001
Invoke-Obfuscation Via Use Clip - Powershell	high	windows / ps_script	T1059.001
Invoke-Obfuscation Via Use Clip - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation Via Use Clip - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Use Clip - System	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Use MSHTA	high	windows / process_creation	T1059.001
Invoke-Obfuscation Via Use MSHTA - PowerShell	high	windows / ps_script	T1059.001
Invoke-Obfuscation Via Use MSHTA - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation Via Use MSHTA - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Use MSHTA - System	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Use Rundll32 - PowerShell	high	windows / ps_script	T1059.001
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module	high	windows / ps_module	T1059.001
Invoke-Obfuscation Via Use Rundll32 - Security	high	windows / NULL	T1059.001
Invoke-Obfuscation Via Use Rundll32 - System	high	windows / NULL	T1059.001
JexBoss Command Sequence	high	linux / NULL	T1059.004
JXA In-memory Execution Via OSAScript	high	macos / process_creation	T1059.002 T1059.007
Malicious Base64 Encoded PowerShell Keywords in Command Lines	high	windows / process_creation	T1059.001
Malicious Nishang PowerShell Commandlets	high	windows / ps_script	T1059.001
Malicious PowerShell Commandlets - PoshModule	high	windows / ps_module	T1059.001
Malicious PowerShell Commandlets - ProcessCreation	high	windows / process_creation	T1059.001
Malicious PowerShell Commandlets - ScriptBlock	high	windows / ps_script	T1059.001
Malicious PowerShell Scripts - FileCreation	high	windows / file_event	T1059.001
Malicious PowerShell Scripts - PoshModule	high	windows / ps_module	T1059.001
Malicious ShellIntel PowerShell Commandlets	high	windows / ps_script	T1059.001
MSHTA Execution with Suspicious File Extensions	high	windows / process_creation	T1059.007
Net WebClient Casing Anomalies	high	windows / process_creation	T1059.001
Network Connection Initiated via Finger.EXE	high	windows / network_connection	T1059.003
NTFS Alternate Data Stream	high	windows / ps_script	T1059.001
Obfuscated PowerShell MSI Install via WindowsInstaller COM	high	windows / process_creation	T1059.001
Obfuscated PowerShell OneLiner Execution	high	windows / process_creation	T1059.001
Operator Bloopers Cobalt Strike Commands	high	windows / process_creation	T1059.003
Operator Bloopers Cobalt Strike Modules	high	windows / process_creation	T1059.003
OSACompile Run-Only Execution	high	macos / process_creation	T1059.002
Outlook EnableUnsafeClientMailRules Setting Enabled	high	windows / process_creation	T1059
PCRE.NET Package Image Load	high	windows / image_load	T1059
PCRE.NET Package Temp Files	high	windows / file_event	T1059
Potential CobaltStrike Process Patterns	high	windows / process_creation	T1059
Potential CommandLine Path Traversal Via Cmd.EXE	high	windows / process_creation	T1059.003
Potential Data Exfiltration Activity Via CommandLine Tools	high	windows / process_creation	T1059.001
Potential Netcat Reverse Shell Execution	high	linux / process_creation	T1059
Potential Persistence Via Powershell Search Order Hijacking - Task	high	windows / process_creation	T1059.001
Potential PowerShell Command Line Obfuscation	high	windows / process_creation	T1059.001
Potential PowerShell Obfuscation Via Reversed Commands	high	windows / process_creation	T1059.001
Potential PowerShell Obfuscation Via WCHAR/CHAR	high	windows / process_creation	T1059.001
Potential Powershell ReverseShell Connection	high	windows / process_creation	T1059.001
Potential Remote PowerShell Session Initiated	high	windows / network_connection	T1059.001
Potential Remote SquiblyTwo Technique Execution	high	windows / process_creation	T1059.005 T1059.007
Potential WinAPI Calls Via PowerShell Scripts	high	windows / ps_script	T1059.001
Potentially Suspicious Command Executed Via Run Dialog Box - Registry	high	windows / registry_set	T1059.001
Potentially Suspicious Execution From Parent Process In Public Folder	high	windows / process_creation	T1059
PowerShell ADRecon Execution	high	windows / ps_script	T1059.001
PowerShell Base64 Encoded FromBase64String Cmdlet	high	windows / process_creation	T1059.001
PowerShell Base64 Encoded IEX Cmdlet	high	windows / process_creation	T1059.001
PowerShell Base64 Encoded Invoke Keyword	high	windows / process_creation	T1059.001
PowerShell Base64 Encoded Reflective Assembly Load	high	windows / process_creation	T1059.001
PowerShell Base64 Encoded WMI Classes	high	windows / process_creation	T1059.001
PowerShell Called from an Executable Version Mismatch	high	windows / ps_classic_start	T1059.001
PowerShell Credential Prompt	high	windows / ps_script	T1059.001
PowerShell Download and Execution Cradles	high	windows / process_creation	T1059
PowerShell DownloadFile	high	windows / process_creation	T1059.001
PowerShell PSAttack	high	windows / ps_script	T1059.001
PowerShell ShellCode	high	windows / ps_script	T1059.001
PowerShell Web Access Installation - PsScript	high	windows / ps_script	T1059.001
PowerView PowerShell Cmdlets - ScriptBlock	high	windows / ps_script	T1059.001
PSAsyncShell - Asynchronous TCP Reverse Shell	high	windows / ps_script	T1059.001
PUA - Wsudo Suspicious Execution	high	windows / process_creation	T1059
Python One-Liners with Base64 Decoding	high	windows / process_creation	T1059.006
Python One-Liners with Base64 Decoding - Linux	high	linux / process_creation	T1059.006
Python Spawning Pretty TTY on Windows	high	windows / process_creation	T1059
Remote LSASS Process Access Through Windows Remote Management	high	windows / process_access	T1059.001
Remote PowerShell Session (PS Module)	high	windows / ps_module	T1059.001
Remote PowerShell Sessions Network Connections (WinRM)	high	windows / NULL	T1059.001
Renamed NirCmd.EXE Execution	high	windows / process_creation	T1059
Renamed PingCastle Binary Execution	high	windows / process_creation	T1059
Run PowerShell Script from Redirected Input Stream	high	windows / process_creation	T1059
Scheduled Task Executing Encoded Payload from Registry	high	windows / process_creation	T1059.001
Script Interpreter Execution From Suspicious Folder	high	windows / process_creation	T1059
Script Interpreter Spawning Credential Scanner - Linux	high	linux / process_creation	T1059.004
Script Interpreter Spawning Credential Scanner - Windows	high	windows / process_creation	T1059.007
Shell Execution via Git - Linux	high	linux / process_creation	T1059
Shell Execution via Rsync - Linux	high	linux / process_creation	T1059
Shell Invocation via Env Command - Linux	high	linux / process_creation	T1059.004
Shell Invocation Via Ssh - Linux	high	linux / process_creation	T1059
Suspicious Activity in Shell Commands	high	linux / NULL	T1059.004
Suspicious ArcSOC.exe Child Process	high	windows / process_creation	T1059
Suspicious Child Process Of BgInfo.EXE	high	windows / process_creation	T1059.005
Suspicious Download and Execute Pattern via Curl/Wget	high	linux / process_creation	T1059.004
Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call	high	windows / process_creation	T1059.001
Suspicious Encoded PowerShell Command Line	high	windows / process_creation	T1059.001
Suspicious File Execution From Internet Hosted WebDav Share	high	windows / process_creation	T1059.001
Suspicious Filename with Embedded Base64 Commands	high	linux / file_event	T1059.004
Suspicious Greedy Compression Using Rar.EXE	high	windows / process_creation	T1059
Suspicious HH.EXE Execution	high	windows / process_creation	T1059.001 T1059.003 T1059.005 T1059.007
Suspicious HWP Sub Processes	high	windows / process_creation	T1059.003
Suspicious Interactive PowerShell as SYSTEM	high	windows / file_event	T1059.001
Suspicious Invocation of Shell via AWK - Linux	high	linux / process_creation	T1059
Suspicious Invocation of Shell via Rsync	high	linux / process_creation	T1059
Suspicious Java Children Processes	high	linux / process_creation	T1059
Suspicious Microsoft Office Child Process - MacOS	high	macos / process_creation	T1059.002
Suspicious Persistence Via VMwareToolBoxCmd.EXE VM State Change Script	high	windows / process_creation	T1059
Suspicious PowerShell Download and Execute Pattern	high	windows / process_creation	T1059.001
Suspicious PowerShell Encoded Command Patterns	high	windows / process_creation	T1059.001
Suspicious PowerShell IEX Execution Patterns	high	windows / process_creation	T1059.001
Suspicious PowerShell Invocations - Generic	high	windows / ps_script	T1059.001
Suspicious PowerShell Invocations - Generic - PowerShell Module	high	windows / ps_module	T1059.001
Suspicious PowerShell Invocations - Specific	high	windows / ps_script	T1059.001
Suspicious PowerShell Invocations - Specific - PowerShell Module	high	windows / ps_module	T1059.001
Suspicious PowerShell Parameter Substring	high	windows / process_creation	T1059.001
Suspicious PowerShell Parent Process	high	windows / process_creation	T1059.001
Suspicious Program Names	high	windows / process_creation	T1059
Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS	high	windows / process_creation	T1059.005
Suspicious Remote Child Process From Outlook	high	windows / process_creation	T1059
Suspicious Reverse Shell Command Line	high	linux / NULL	T1059.004
Suspicious Schtasks Execution AppData Folder	high	windows / process_creation	T1059.001
Suspicious Scripting in a WMI Consumer	high	windows / wmi_event	T1059.005
Vim GTFOBin Abuse - Linux	high	linux / process_creation	T1059
VMToolsd Suspicious Child Process	high	windows / process_creation	T1059
Windows Defender AMSI Trigger Detected	high	windows / NULL	T1059
Windows Defender Threat Detected	high	windows / NULL	T1059
Windows Shell/Scripting Application File Write to Suspicious Folder	high	windows / file_event	T1059
Windows Shell/Scripting Processes Spawning Suspicious Programs	high	windows / process_creation	T1059.001 T1059.005
WMImplant Hack Tool	high	windows / ps_script	T1059.001
WScript or CScript Dropper - File	high	windows / file_event	T1059.005 T1059.007
Add New Download Source To Winget	medium	windows / process_creation	T1059
Add Potential Suspicious New Download Source To Winget	medium	windows / process_creation	T1059
Alternate PowerShell Hosts - PowerShell Module	medium	windows / ps_module	T1059.001
Alternate PowerShell Hosts Pipe	medium	windows / pipe_created	T1059.001
AppLocker Application Would Have Been Blocked	medium	windows / NULL	T1059.001 T1059.003 T1059.005 T1059.006 T1059.007
AppLocker Prevented Application or Script from Running	medium	windows / NULL	T1059.001 T1059.003 T1059.005 T1059.006 T1059.007
Azure New CloudShell Created	medium	azure / NULL	T1059
BPFtrace Unsafe Option Usage	medium	linux / process_creation	T1059.004
Certificate Exported Via PowerShell	medium	windows / process_creation	T1059.001
Change PowerShell Policies to an Insecure Level	medium	windows / process_creation	T1059.001
Change PowerShell Policies to an Insecure Level - PowerShell	medium	windows / ps_script	T1059.001
Clfs.SYS Loaded By Process Located In a Potential Suspicious Location	medium	windows / image_load	T1059
Clipboard Access Via OSAScript	medium	macos / process_creation	T1059.002
Command Line Execution with Suspicious URL and AppData Strings	medium	windows / process_creation	T1059.001 T1059.003
Conhost Spawned By Uncommon Parent Process	medium	windows / process_creation	T1059
ConvertTo-SecureString Cmdlet Usage Via CommandLine	medium	windows / process_creation	T1059.001
Detection of PowerShell Execution via Sqlps.exe	medium	windows / process_creation	T1059.001
Elevated System Shell Spawned From Uncommon Parent Location	medium	windows / process_creation	T1059
ESXi Account Creation Via ESXCLI	medium	linux / process_creation	T1059.012
ESXi Network Configuration Discovery Via ESXCLI	medium	linux / process_creation	T1059.012
ESXi Storage Information Discovery Via ESXCLI	medium	linux / process_creation	T1059.012
ESXi Syslog Configuration Change Via ESXCLI	medium	linux / process_creation	T1059.012
ESXi System Information Discovery Via ESXCLI	medium	linux / process_creation	T1059.012
ESXi VM Kill Via ESXCLI	medium	linux / process_creation	T1059.012
ESXi VM List Discovery Via ESXCLI	medium	linux / process_creation	T1059.012
ESXi VSAN Information Discovery Via ESXCLI	medium	linux / process_creation	T1059.012
Execute Code with Pester.bat	medium	windows / process_creation	T1059.001
Execute Code with Pester.bat as Parent	medium	windows / process_creation	T1059.001
Forfiles Command Execution	medium	windows / process_creation	T1059
HackTool - Jlaive In-Memory Assembly Execution	medium	windows / process_creation	T1059.003
Hidden Powershell in Link File Pattern	medium	windows / process_creation	T1059.001
Import PowerShell Modules From Suspicious Directories	medium	windows / ps_script	T1059.001
Import PowerShell Modules From Suspicious Directories - ProcCreation	medium	windows / process_creation	T1059.001
Install New Package Via Winget Local Manifest	medium	windows / process_creation	T1059
Interactive Bash Suspicious Children	medium	linux / process_creation	T1059.004
Invoke-Obfuscation COMPRESS OBFUSCATION	medium	windows / process_creation	T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell	medium	windows / ps_script	T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module	medium	windows / ps_module	T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - Security	medium	windows / NULL	T1059.001
Invoke-Obfuscation COMPRESS OBFUSCATION - System	medium	windows / NULL	T1059.001
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell	medium	windows / ps_script	T1059.001
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module	medium	windows / ps_module	T1059.001
Invoke-Obfuscation RUNDLL LAUNCHER - Security	medium	windows / NULL	T1059.001
Invoke-Obfuscation RUNDLL LAUNCHER - System	medium	windows / NULL	T1059.001
MacOS Scripting Interpreter AppleScript	medium	macos / process_creation	T1059.002
Malicious PowerShell Keywords	medium	windows / ps_script	T1059.001
MMC Loading Script Engines DLLs	medium	windows / image_load	T1059.005
Netcat The Powershell Version	medium	windows / ps_classic_start	T1059.001
New Agent Skills Installation Attempt Via Node.EXE	medium	windows / process_creation	T1059.007
Node Process Executions	medium	windows / process_creation	T1059.007
Nohup Execution	medium	linux / process_creation	T1059.004
Nslookup PowerShell Download Cradle	medium	windows / ps_classic_start	T1059.001
OpenEDR Spawning Command Shell	medium	windows / process_creation	T1059.003
Osacompile Execution By Potentially Suspicious Applet/Osascript	medium	macos / process_creation	T1059.002
Payload Decoded and Decrypted via Built-in Utilities	medium	macos / process_creation	T1059
Perl Inline Command Execution	medium	windows / process_creation	T1059
Php Inline Command Execution	medium	windows / process_creation	T1059
Potential Abuse of Linux Magic System Request Key	medium	linux / NULL	T1059.004
Potential Arbitrary Command Execution Via FTP.EXE	medium	windows / process_creation	T1059
Potential DLL File Download Via PowerShell Invoke-WebRequest	medium	windows / process_creation	T1059.001
Potential Dosfuscation Activity	medium	windows / process_creation	T1059
Potential Dropper Script Execution Via WScript/CScript/MSHTA	medium	windows / process_creation	T1059.005 T1059.007
Potential In-Memory Download And Compile Of Payloads	medium	macos / process_creation	T1059.007
Potential Persistence Via VMwareToolBoxCmd.EXE VM State Change Script	medium	windows / process_creation	T1059
Potential PowerShell Downgrade Attack	medium	windows / process_creation	T1059.001
Potential Reconnaissance Activity Via GatherNetworkInfo.VBS	medium	windows / process_creation	T1059.005
Potential Suspicious PowerShell Keywords	medium	windows / ps_script	T1059.001
Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell	medium	windows / process_creation	T1059.001
Potential Xterm Reverse Shell	medium	linux / process_creation	T1059
Potentially Suspicious Inline JavaScript Execution via NodeJS Binary	medium	windows / process_creation	T1059.007
Potentially Suspicious NTFS Symlink Behavior Modification	medium	windows / process_creation	T1059
Potentially Suspicious Powershell Script Execution From Temp Folder	medium	windows / process_creation	T1059.001
Potentially Suspicious WebDAV LNK Execution	medium	windows / process_creation	T1059.001
PowerShell Core DLL Loaded By Non PowerShell Process	medium	windows / image_load	T1059.001
PowerShell Create Local User	medium	windows / ps_script	T1059.001
PowerShell Downgrade Attack - PowerShell	medium	windows / ps_classic_start	T1059.001
PowerShell Download Pattern	medium	windows / process_creation	T1059.001
Powershell Execute Batch Script	medium	windows / ps_script	T1059.003
Powershell Executed From Headless ConHost Process	medium	windows / process_creation	T1059.001 T1059.003
Powershell Inline Execution From A File	medium	windows / process_creation	T1059.001
PowerShell MSI Install via WindowsInstaller COM From Remote Location	medium	windows / process_creation	T1059.001
Powershell MsXml COM Object	medium	windows / ps_script	T1059.001
PowerShell Remote Session Creation	medium	windows / ps_script	T1059.001
PowerShell Script Run in AppData	medium	windows / process_creation	T1059.001
PowerShell Web Download	medium	windows / process_creation	T1059.001
Powershell XML Execute Command	medium	windows / ps_script	T1059.001
PUA - AdvancedRun Execution	medium	windows / process_creation	T1059.003
Python Inline Command Execution	medium	windows / process_creation	T1059
Python Spawning Pretty TTY Via PTY Module	medium	linux / process_creation	T1059
Read Contents From Stdin Via Cmd.EXE	medium	windows / process_creation	T1059.003
Registry Modification Attempt Via VBScript	medium	windows / process_creation	T1059.005
Registry Modification Attempt Via VBScript - PowerShell	medium	windows / ps_script	T1059.005
Registry Tampering by Potentially Suspicious Processes	medium	windows / registry_event	T1059.005
Remote PowerShell Session Host Process (WinRM)	medium	windows / process_creation	T1059.001
Remote Thread Creation Via PowerShell In Uncommon Target	medium	windows / create_remote_thread	T1059.001
Renamed CURL.EXE Execution	medium	windows / process_creation	T1059
Renamed FTP.EXE Execution	medium	windows / process_creation	T1059
Ruby Inline Command Execution	medium	windows / process_creation	T1059
Scheduled Task Executing Payload from Registry	medium	windows / process_creation	T1059.001
SQL Client Tools PowerShell Session Detection	medium	windows / process_creation	T1059.001
Suspicious Browser Child Process - MacOS	medium	macos / process_creation	T1059
Suspicious Commands Linux	medium	linux / NULL	T1059.004
Suspicious Execution of Powershell with Base64	medium	windows / process_creation	T1059.001
Suspicious Execution via macOS Script Editor	medium	macos / process_creation	T1059 T1059.002
Suspicious File Characteristics Due to Missing Fields	medium	windows / process_creation	T1059.006
Suspicious File Created In PerfLogs	medium	windows / file_event	T1059

Rule

Level

Log source

Technique

Bad Opsec Powershell Code Artifacts

critical

windows / ps_module

T1059.001

HackTool - Sliver C2 Implant Activity Pattern

critical

windows / process_creation

T1059

Linux Reverse Shell Indicator

critical

linux / network_connection

T1059.004

Silence.EDA Detection

critical

windows / ps_script

T1059.001

Abusable DLL Potential Sideloading From Suspicious Location

high

windows / image_load

T1059

Add Insecure Download Source To Winget

high

windows / process_creation

T1059

Adwind RAT / JRAT File Artifact

high

windows / file_event

T1059.005 T1059.007

Atlassian Confluence CVE-2022-26134

high

linux / process_creation

T1059

AWS EC2 Startup Shell Script Change

high

aws / NULL

T1059.001 T1059.003 T1059.004

AWS IAM S3Browser LoginProfile Creation

high

aws / NULL

T1059.009

AWS IAM S3Browser Templated S3 Bucket Policy Creation

high

aws / NULL

T1059.009

AWS IAM S3Browser User or AccessKey Creation

high

aws / NULL

T1059.009

Base64 Encoded PowerShell Command Detected

high

windows / process_creation

T1059.001

BloodHound Collection Files

high

windows / file_event

T1059.001

BPFDoor Abnormal Process ID or Lock File Accessed

high

linux / NULL

T1059

Rule	Type	Risk	Data source	Technique
Any Powershell DownloadFile	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
Any Powershell DownloadString	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
CHCP Command Execution	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059
Cisco IOS XE Guestshell Activation and Destroy	Anomaly	NULL	Cisco IOS Logs	T1059
Cisco IOS XE Request Platform Package Describe Shell Pattern	TTP	NULL	Cisco IOS Logs	T1059
Cisco NVM - Browser Spawned Unix Shell with External Connection	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1059
Cisco NVM - Installation of Typosquatted Python Package	TTP	NULL	Cisco Network Visibility Module Flow Data	T1059
Cisco NVM - MSHTML or MSHTA Network Execution Without URL in CLI	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1059.005
Cisco NVM - Osascript Network Connection for a Long Duration	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1059.002
Cisco NVM - Susp Script From Archive Triggering Network Activity	Anomaly	NULL	Cisco Network Visibility Module Flow Data	T1059.005
Cisco NVM - Suspicious File Download via Headless Browser	TTP	NULL	Cisco Network Visibility Module Flow Data	T1059
Cisco Secure Firewall - Binary File Type Download	Anomaly	NULL	Cisco Secure Firewall Threat Defense File Event	T1059
Cisco Secure Firewall - Citrix NetScaler Memory Overread Attempt	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1059
Cisco Secure Firewall - Communication Over Suspicious Ports	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1059.001
Cisco Secure Firewall - High Volume of Intrusion Events Per Host	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1059
Cisco Secure Firewall - Possibly Compromised Host	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1059
Cisco Secure Firewall - Privileged Command Execution via HTTP	Anomaly	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1059
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1059.001
Cisco Secure Firewall - Wget or Curl Download	Anomaly	NULL	Cisco Secure Firewall Threat Defense Connection Event	T1059
CMD Carry Out String Command Parameter	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
CMD Echo Pipe - Escalation	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
Cmdline Tool Not Executed In CMD Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.007
CrushFTP Authentication Bypass Exploitation	TTP	NULL	CrushFTP	T1059.001 T1059.003
Detect Certify With PowerShell Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Detect Empire with PowerShell Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Detect Mimikatz With PowerShell Script Block Logging	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Detect Outbound LDAP Traffic	Hunting	NULL	Palo Alto Network Traffic, Cisco Secure Firewall Threat Defense Connection Event, Cisco Secure Access Firewall	T1059
Detect Prohibited Applications Spawning cmd exe	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
Detect suspicious processnames using pretrained model in DSDL	Anomaly	NULL	Sysmon EventID 1	T1059
Detect Use of cmd exe to Launch Script Interpreters	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
ESXi Reverse Shell Patterns	TTP	NULL	VMWare ESXi Syslog	T1059
Excessive distinct processes from Windows Temp	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Excessive number of taskhost processes	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Exchange PowerShell Module Usage	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Execute Javascript With Jscript COM CLSID	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.005
First time seen command line argument	Hunting	NULL	Sysmon EventID 1	T1059.001 T1059.003
Get-ForestTrust with PowerShell Script Block	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
GetLocalUser with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104	T1059.001
GetWmiObject User Account with PowerShell Script Block	Hunting	NULL	Powershell Script Block Logging 4104	T1059.001
Jscript Execution Using Cscript App	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.007
Juniper Networks Remote Code Execution Exploit Detection	TTP	NULL	Suricata	T1059
Linux Binary Executed from Shared Memory Directory	Anomaly	NULL	Sysmon for Linux EventID 1	T1059
Linux Decode Base64 to Shell	TTP	NULL	Sysmon for Linux EventID 1, Cisco Isovalent Process Exec	T1059.004
Linux Docker Shell Execution	Anomaly	NULL	Sysmon for Linux EventID 1	T1059.013
Linux Ghostscript Exploitation	TTP	NULL	Sysmon for Linux EventID 1	T1059
Linux Magic SysRq Key Abuse	TTP	NULL	Linux Auditd Path, Linux Auditd Cwd	T1059.004
Linux MOTD Script Added	Anomaly	NULL	Sysmon for Linux EventID 11	T1059.004
Linux Netcat Outbound Connection	Anomaly	NULL	Sysmon for Linux EventID 3	T1059.004
Linux Possible System Binary Backdoor	Anomaly	NULL	Sysmon for Linux EventID 11	T1059.004
Linux Shell Pseudo Device Reverse Shell	Anomaly	NULL	Sysmon for Linux EventID 1	T1059
Linux Suspicious Privileged Container Execution	Anomaly	NULL	Sysmon for Linux EventID 1	T1059.004
Linux Suspicious React or Next.js Child Process	TTP	NULL	Sysmon for Linux EventID 1	T1059.004
Linux Suspicious XDG Autostart	Anomaly	NULL	Sysmon for Linux EventID 11	T1059.004
Linux Unix Shell Enable All SysRq Functions	Anomaly	NULL	Sysmon for Linux EventID 1	T1059.004
Living Off The Land Detection	Correlation	NULL		T1059
Log4Shell CVE-2021-44228 Exploitation	Correlation	NULL		T1059
MacOS AMOS Stealer - Virtual Machine Check Activity	Anomaly	NULL	Osquery Results	T1059.002
MacOS AppleScript Shell Execution and Compilation	Anomaly	NULL	Osquery Results	T1059.002
MacOS LOLbin	TTP	NULL	Osquery Results	T1059.004
MacOS Osascript Displaying Suspicious User Prompt	Anomaly	NULL	Osquery Results	T1059.002
MacOS Osascript Executing Interactive Shell	Anomaly	NULL	Osquery Results	T1059.002 T1059.004
MacOS Osascript Executing JavaScript Code With ObjC	Anomaly	NULL	Osquery Results	T1059.002 T1059.007
Malicious PowerShell Process - Execution Policy Bypass	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
Malicious PowerShell Process With Obfuscation Techniques	TTP	NULL	Sysmon EventID 1	T1059.001
MCP Filesystem Server Suspicious Extension Write	Hunting	NULL	MCP Server	T1059
MCP Prompt Injection	TTP	NULL	MCP Server	T1059
MS Scripting Process Loading Ldap Module	Anomaly	NULL	Sysmon EventID 7	T1059.007
MS Scripting Process Loading WMI Module	Anomaly	NULL	Sysmon EventID 7	T1059.007
Nishang PowershellTCPOneLine	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
Ollama Suspicious Prompt Injection Jailbreak	Anomaly	NULL	Ollama Server	T1059
Possible Lateral Movement PowerShell Spawn	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001
Potentially malicious code on commandline	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
PowerShell - Connect To Internet With Hidden Window	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
PowerShell 4104 Hunting	Hunting	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell COM Hijacking InprocServer32 Modification	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Creating Thread Mutex	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Defender Threat Actions Set to Allow	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
PowerShell Domain Enumeration	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
PowerShell Enable PowerShell Remoting	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
PowerShell Environment Variable Execution	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Execute COM Object	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Fileless Process Injection via GetProcAddress	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Fileless Script Contains Base64 Encoded Content	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Load Module in Meterpreter	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
PowerShell Loading DotNET into Memory via Reflection	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
PowerShell PInvoke Process Injection API Chain	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Processing Stream Of Data	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
PowerShell Script Block With URL Chain	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
PowerShell Start or Stop Service	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Powershell Using memory As Backing Store	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
PowerShell WebRequest Using Memory Stream	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Process Writing DynamicWrapperX	Hunting	NULL	Sysmon EventID 11	T1059
PTC Windchill Gateway Command Execution	Anomaly	NULL	Windchill Log4j	T1059
PTC Windchill GW READY OK Probe	Anomaly	NULL	Windchill Log4j	T1059
Python Network Traffic During Package Build	Anomaly	NULL	Sysmon EventID 1 AND Sysmon EventID 3	T1059.006
Recon Using WMI Class	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Ryuk Wake on LAN Command	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
Set Default PowerShell Execution Policy To Unrestricted or Bypass	TTP	NULL	Sysmon EventID 13	T1059.001
Socat Network Listener Binding an Executable	TTP	NULL	Osquery Results, Sysmon for Linux EventID 1	T1059
Socat Remote TCP Connection with Local Echo Disabled	Anomaly	NULL	Osquery Results, Sysmon for Linux EventID 1	T1059
Suspicious Linux Discovery Commands	TTP	NULL	Sysmon for Linux EventID 1	T1059.004
Suspicious Powershell Command-Line Arguments	TTP	NULL	Sysmon EventID 1	T1059.001
Suspicious Process DNS Query Known Abuse Web Services	TTP	NULL	Sysmon EventID 22	T1059.005
Suspicious Process With Discord DNS Query	Anomaly	NULL	Sysmon EventID 22	T1059.005
Unloading AMSI via Reflection	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Vbscript Execution Using Wscript App	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.005
Wermgr Process Spawned CMD Or Powershell Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Account Access Removal via Logoff Exec	Anomaly	NULL	Sysmon EventID 1	T1059.001
Windows Apache Benchmark Binary	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows AutoIt3 Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Cmdline Tool Execution From Non-Shell Process	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.007
Windows Cobalt Strike PowerShell Loader	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Windows Command and Scripting Interpreter Hunting Path Traversal	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Command and Scripting Interpreter Path Traversal Exec	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Command Shell DCRat ForkBomb Payload	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003
Windows Common Abused Cmd Shell Risk Behavior	Correlation	NULL		T1059
Windows connhost exe started forcefully	TTP	NULL	Sysmon EventID 1	T1059.003
Windows Content Copied from Browser was Executed	TTP	NULL	Sysmon EventID 13 AND Sysmon EventID 24	T1059.001 T1059.003
Windows Crowdstrike RTR Script Execution	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001
Windows Default Cobalt Strike PowerShell Beacon	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Windows Defender ASR Audit Events	Anomaly	NULL	Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1132, Windows Event Log Defender 1134	T1059
Windows Defender ASR Block Events	Anomaly	NULL	Windows Event Log Defender 1121, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133	T1059
Windows Defender ASR Rules Stacking	Hunting	NULL	Windows Event Log Defender 1121, Windows Event Log Defender 1122, Windows Event Log Defender 1125, Windows Event Log Defender 1126, Windows Event Log Defender 1129, Windows Event Log Defender 1131, Windows Event Log Defender 1133, Windows Event Log Defender 1134, Windows Event Log Defender 5007	T1059
Windows Enable PowerShell Web Access	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Windows Explorer LNK Exploit Process Launch With Padding	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1059.001
Windows Explorer.exe Spawning PowerShell or Cmd	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1059.001
Windows File Association Modification via Ftype	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
Windows File Download Via PowerShell	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1059.001
Windows For Loop Usage Within Cmd.exe To Execute Commands	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.003
Windows GrimResource - MMC Process Accessing APDS DLL	TTP	NULL	Windows Event Log Security 4663	T1059.007
Windows Identify Protocol Handlers	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows MSExchange Management Mailbox Cmdlet Usage	Anomaly	NULL		T1059.001
Windows Node.exe Executing JS Script In Immediate Folder	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.007
Windows Outlook Macro Created by Suspicious Process	TTP	NULL	Sysmon EventID 11	T1059.005
Windows PaperCut NG Spawn Shell	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Powershell Commands from DNS TXT	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows Powershell Cryptography Namespace	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell FakeCAPTCHA Clipboard Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2, Cisco Network Visibility Module Flow Data	T1059.001 T1059.003
Windows PowerShell Get CIMInstance Remote Computer	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows Powershell History File Deletion	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.003
Windows Powershell Import Applocker Policy	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell Invoke-RestMethod IP Information Collection	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell Invoke-Sqlcmd Execution	Hunting	NULL	Powershell Script Block Logging 4104	T1059.001 T1059.003
Windows Powershell Logoff User via Quser	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell Module File Created	Anomaly	NULL	Sysmon EventID 11	T1059.001
Windows PowerShell MSIX Package Installation	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell Process Implementing Manual Base64 Decoder	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
Windows PowerShell Process With Malicious String	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001
Windows Powershell RemoteSigned File	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
Windows PowerShell ScheduleTask	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell Script Block With Malicious String	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell Script From WindowsApps Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001
Windows PowerShell Script TabExpansion Direct Call	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowerShell WMI Win32 ScheduledJob	TTP	NULL	Powershell Script Block Logging 4104	T1059.001
Windows PowGoop Beacon Decoding	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001
Windows Process Accessing IronLanguages Repository On GitHub	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Process Accessing Windows Recall Directory	Anomaly	NULL	Windows Event Log Security 4663	T1059
Windows Process Execution From RDP Share	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Remote Image Load	Anomaly	NULL	Sysmon EventID 7	T1059
Windows Scheduled Task Service Spawned Shell	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059
Windows Shell Process from CrushFTP	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.001 T1059.003
Windows Software Discovery Via PowerShell	Anomaly	NULL	Powershell Script Block Logging 4104	T1059.001
Windows SQL Server Extended Procedure DLL Loading Hunt	Hunting	NULL	Windows Event Log Application 8128	T1059.009
Windows SQLCMD Execution	Hunting	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059.003
Windows SSH Proxy Command	Anomaly	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001
Windows Suspicious Child Process of Consent.EXE	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows Suspicious React or Next.js Child Process	TTP	NULL	Sysmon EventID 1, CrowdStrike ProcessRollup2	T1059.001 T1059.003
Windows Suspicious VMWare Tools Child Process	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows TeamCity Payload Execution from Temp Directory	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows TeamCity Plugin Installed	Anomaly	NULL	Sysmon EventID 11	T1059
Windows TinyCC Shellcode Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688	T1059.003
Windows WinDBG Spawning AutoIt3	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1059
Windows XLL File Creation Outside of Typical Location	Anomaly	NULL	Sysmon EventID 11	T1059

Rule

Type

Risk

Data source

Technique

Any Powershell DownloadFile

TTP

NULL

Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

T1059.001

Any Powershell DownloadString

TTP

NULL

Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2

T1059.001

CHCP Command Execution

Anomaly

NULL

Sysmon EventID 1, CrowdStrike ProcessRollup2

T1059

Cisco IOS XE Guestshell Activation and Destroy

Anomaly

NULL

Cisco IOS Logs

T1059

Cisco IOS XE Request Platform Package Describe Shell Pattern

TTP

NULL

Cisco IOS Logs

T1059

Cisco NVM - Browser Spawned Unix Shell with External Connection

Anomaly

NULL