Techniques › T1059.001 › AN1252
AN1252 Analytic 1252
Windows · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Detects behavioral chains where PowerShell is launched with encoded commands, unusual parent processes, or suspicious modules loaded, potentially followed by network connections or child process spawning. Supports detection of both direct (powershell.exe) and indirect (.NET automation) invocations.</p>
- Detects
- T1059.001 PowerShell
- Part of
- DET0455 Abuse of PowerShell for Arbitrary Execution
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| WinEventLog:Sysmon | EventCode=1 | DC0032 Process Creation |
| WinEventLog:PowerShell | EventCode=4103, 4104, 4105, 4106 | DC0064 Command Execution |
| WinEventLog:PowerShell | EventCode=400, 403 | DC0034 Process Metadata |
| WinEventLog:Sysmon | EventCode=7 | DC0016 Module Load |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
CommandLinePattern | Regex pattern for encoded, obfuscated, or hidden PowerShell arguments (e.g., '-enc', '-nop'). |
ParentProcessName | Filter based on abnormal parents like Excel, WinWord, or mshta spawning PowerShell. |
TimeWindow | Scope detection to off-hours, lateral movement timeframes, or non-maintenance windows. |
LoadedModuleList | Tuneable to monitor rare or never-before-seen .NET assemblies tied to PowerShell abuse. |
ScriptBlockLengthThreshold | Adjustable threshold for length of script blocks logged by Event ID 4104 (useful for filtering noise). |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2022-41082 | Microsoft Exchange Server | Mapped |