Detect PowerShell in IBM QRadar
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. PowerShell can also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.
MITRE ATT&CK
- Tactic
- Execution
- Technique
- T1059 Command and Scripting Interpreter
- Sub-technique
- T1059.001 PowerShell
- Canonical reference
- https://attack.mitre.org/techniques/T1059/001/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS EventTime,
LOGSOURCENAME(logsourceid) AS LogSource,
username AS Username,
devicehostname AS Hostname,
"Process Name" AS ProcessName,
"Process CommandLine" AS CommandLine,
"Parent Process Name" AS ParentProcess,
CASE
WHEN LOWER("Process CommandLine") ILIKE '%-encodedcommand%'
OR LOWER("Process CommandLine") ILIKE '%-enc %'
OR LOWER("Process CommandLine") ILIKE '%-e %'
OR LOWER("Process CommandLine") ILIKE '%-ec %'
THEN 1 ELSE 0 END AS EncodedCmd,
CASE
WHEN LOWER("Process CommandLine") ILIKE '%invoke-webrequest%'
OR LOWER("Process CommandLine") ILIKE '%iwr %'
OR LOWER("Process CommandLine") ILIKE '%net.webclient%'
OR LOWER("Process CommandLine") ILIKE '%downloadstring%'
OR LOWER("Process CommandLine") ILIKE '%downloadfile%'
OR LOWER("Process CommandLine") ILIKE '%start-bitstransfer%'
THEN 1 ELSE 0 END AS DownloadCradle,
CASE
WHEN LOWER("Process CommandLine") ILIKE '%amsiutils%'
OR LOWER("Process CommandLine") ILIKE '%amsiinitfailed%'
OR LOWER("Process CommandLine") ILIKE '%setprotectionlevel%'
THEN 1 ELSE 0 END AS AmsiBypass,
CASE
WHEN LOWER("Process CommandLine") ILIKE '%-executionpolicy bypass%'
OR LOWER("Process CommandLine") ILIKE '%-ep bypass%'
THEN 1 ELSE 0 END AS PolicyBypass,
CASE
WHEN LOWER("Process CommandLine") ILIKE '%-windowstyle hidden%'
OR LOWER("Process CommandLine") ILIKE '%-w hidden%'
THEN 1 ELSE 0 END AS HiddenWindow,
CASE
WHEN LOWER("Process CommandLine") ILIKE '%invoke-expression%'
OR LOWER("Process CommandLine") ILIKE '%iex(%'
THEN 1 ELSE 0 END AS InvokeExpression
FROM events
WHERE LOGSOURCETYPENAME(devicetype) IN (
'Microsoft Windows Security Event Log',
'Microsoft Sysmon'
)
AND eventid IN (4688, 1)
AND (LOWER("Process Name") LIKE '%powershell.exe' OR LOWER("Process Name") LIKE '%pwsh.exe')
AND (
LOWER("Process CommandLine") ILIKE '%-encodedcommand%'
OR LOWER("Process CommandLine") ILIKE '%-enc %'
OR LOWER("Process CommandLine") ILIKE '%invoke-webrequest%'
OR LOWER("Process CommandLine") ILIKE '%net.webclient%'
OR LOWER("Process CommandLine") ILIKE '%downloadstring%'
OR LOWER("Process CommandLine") ILIKE '%downloadfile%'
OR LOWER("Process CommandLine") ILIKE '%downloaddata%'
OR LOWER("Process CommandLine") ILIKE '%start-bitstransfer%'
OR LOWER("Process CommandLine") ILIKE '%amsiutils%'
OR LOWER("Process CommandLine") ILIKE '%amsiinitfailed%'
OR LOWER("Process CommandLine") ILIKE '%setprotectionlevel%'
OR LOWER("Process CommandLine") ILIKE '%-executionpolicy bypass%'
OR LOWER("Process CommandLine") ILIKE '%-ep bypass%'
OR LOWER("Process CommandLine") ILIKE '%-windowstyle hidden%'
OR LOWER("Process CommandLine") ILIKE '%-w hidden%'
OR LOWER("Process CommandLine") ILIKE '%invoke-expression%'
OR LOWER("Process CommandLine") ILIKE '%iex(%'
OR LOWER("Process CommandLine") ILIKE '%frombase64string%'
OR LOWER("Process CommandLine") ILIKE '%invoke-mimikatz%'
OR LOWER("Process CommandLine") ILIKE '%invoke-shellcode%'
)
LAST 24 HOURSDetects suspicious PowerShell execution in IBM QRadar using AQL against Windows Security Event Log (Event ID 4688) and Sysmon (Event ID 1) log sources. Includes per-indicator CASE flags and filters to powershell.exe and pwsh.exe process names.
Data Sources
Required Tables
False Positives & Tuning
- Endpoint management platforms (e.g., SCCM, Intune) that routinely invoke PowerShell with -EncodedCommand for policy enforcement scripts
- Vulnerability scanners (e.g., Tenable, Qualys) executing PowerShell-based WMI queries that include Net.WebClient-style patterns
- Build servers and CI agents (Jenkins, TeamCity, Azure DevOps) pulling scripts or artifacts via Invoke-WebRequest during pipeline execution
Other platforms for T1059.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Encoded Command Execution
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing '-EncodedCommand dwBoAG8AYQBtAGkA'. Security Event ID 4688 (if command line auditing enabled) with same details. PowerShell ScriptBlock Log Event ID 4104 will show the decoded content 'whoami'.
- Test 2Download Cradle via Net.WebClient
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'Net.WebClient' and 'DownloadString'. Sysmon Event ID 3: Network Connection to 127.0.0.1:8080. PowerShell ScriptBlock Log Event ID 4104 with full script content. The connection will fail (no listener) but the process creation event still fires.
- Test 3AMSI Bypass via Reflection
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'AmsiUtils' and 'amsiInitFailed'. PowerShell ScriptBlock Log Event ID 4104 with the reflection code. Windows Defender Event ID 1116 (AMSI detection) in Microsoft-Windows-Windows Defender/Operational log.
- Test 4Execution Policy Bypass with Hidden Window
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing '-ExecutionPolicy Bypass' and '-WindowStyle Hidden'. File creation event (Sysmon Event ID 11) for the temp file. PowerShell ScriptBlock Log Event ID 4104.
References (8)
- https://attack.mitre.org/techniques/T1059/001/
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/powershell
- https://www.mandiant.com/resources/blog/obfuscation-wild-targeted-attackers-lead-way-evasion
- https://s3cur3th1ssh1t.github.io/Powershell-and-the-NET-AMSI-Interface/
Unlock Pro Content
Get the full detection package for T1059.001 including response playbook, investigation guide, and atomic red team tests.