T1059.001sub-technique of T1059 Command and Scripting Interpreter
PowerShell
Windows13 pieces on this siteT1059.001 on attack.mitre.org
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Detect it
Hunts and rules you can run, each stating what it needs and what else it returns.
Q3 detection rule pack: persistence and execution
Sigma, YARA and network rules built from the quarter's CISA advisories, with the advisory cited on every rule and the indicator table they came from attached as CSV.
Sigma endpoint pack: seven rules for the Windows techniques that keep working
Shadow copy deletion, LSASS dumping through comsvcs, long encoded PowerShell, scheduled tasks and services in user-writable paths, WMI subscriptions and a cleared Security log. Each rule ships with the false positives it was written expecting.
YARA triage samples: five heuristic rules for a web root, a script directory or a triage collection
Request-fed web shells in PHP and ASP.NET, PowerShell that decodes, executes and reaches the network in one file, ransom notes, and LSASS minidumps left on disk. Hunting rules that produce files to open, not verdicts.
Find obfuscated or downloading script blocks without drowning in administrative PowerShell.
The evidence it leaves
Where the traces live, and what each source proves and does not.
PowerShell script block logging (4104)
Practise it
Labs, timelines, evidence packs and tabletop scenarios to work before you need to.
Guided lab: read Windows event logs without Windows
Every other lab here asks for a virtual machine. This one asks for a terminal. Pre-recorded event logs, a cross-platform parser, and the same reasoning, on whatever laptop you already have.
Guided lab: nine hours at Northwind Freight, from lure to scheduled task
A constructed intrusion written as a DFIR report. You get the same artifacts an analyst gets on day one, in the order they arrive, and you build the timeline yourself. The company is fictional; the techniques, event IDs and analytic reasoning are not.
Read
Analyses, case studies, guides, references and interview questions.
Mini-guide: a PowerShell alert in ninety seconds, in the order that settles it fastest
Most PowerShell alerts are administration. Five questions, ordered so the cheapest one that can close the alert comes first, with the answer that means stop and the answer that means keep going.
Incident report: Kesterline Components, 8 May 2026
A full DFIR report on a constructed ransomware incident, written the way one gets handed to a board. Three hours twenty from first execution to encryption, four separate points where it could have been stopped, and the write-up that follows.
Emulating T1059.001 until the detection actually fires
Four variants of the same PowerShell technique, three of which walked past a rule that looked fine on paper. Notes from a purple team afternoon.
Windows event log cheat sheet: by the question you are asking
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
PowerShell -EncodedCommand to readable script
The two operations that turn the base64 after -e, -enc or -EncodedCommand into the script that ran. Short, and the one you will use most.
how MITRE says to see it
Abuse of PowerShell for Arbitrary Execution
- Detects behavioral chains where PowerShell is launched with encoded commands, unusual parent processes, or suspicious modules loaded, potentially followed by network connections or child process spawning. Supports detection of both direct (powershell.exe) and indirect (.NET automation) invocations.
what reduces it
- M1038 Execution Prevention. Use application control where appropriate. PowerShell Constrained Language mode can be used to restrict access to sensitive or otherwise dangerous language elements such as those used to execute arbitrary Windows APIs or files (e.g., `Add-Type`).
- M1045 Code Signing. Set PowerShell execution policy to execute only signed scripts.
- M1026 Privileged Account Management. When PowerShell is necessary, consider restricting PowerShell execution policy to administrators. Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration. PowerShell JEA (Just Enough Administration) may also be used to sandbox administration and limit what commands admins/users can execute through remote PowerShell sessions.
- M1049 Antivirus/Antimalware. Anti-virus can be used to automatically quarantine suspicious files.
- M1042 Disable or Remove Feature or Program. It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions. Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.