Potential Commands Executed By A Power Shellexe Renamed

Query

DeviceProcessEvents
| where   ProcessCommandLine !contains "powershell"  
| where  ProcessCommandLine !contains "pwsh"
| where  ProcessCommandLine contains "-NoProfile" or ProcessCommandLine contains "-ExecutionPolicy" or  ProcessCommandLine contains "Invoke-Expression" 
| project DeviceName, FileName,ActionType, ProcessVersionInfoOriginalFileName, ProcessCommandLine, ProcessRemoteSessionIP

About this query

MITRE ATT&CK Technique(s)

Technique ID	Title
T1036.003	Masquerading: Rename System Utilities

Author: Sergio Albea (12/06/2025)

Potential commands executed by a powerShell.exe renamed

PowerShell is a trusted Microsoft tool that attackers can misuse by renaming its executable file to hide their actions and deliver threats. The following query, detect cli common commands to identify the mentioned executions by a renamed Powershell.

Explanation

This query is designed to detect potentially malicious use of PowerShell by identifying instances where the PowerShell executable has been renamed to disguise its activity. Here's a simple breakdown of what the query does:

Data Source: The query examines events related to processes on devices (DeviceProcessEvents).
Filtering Criteria:
- It looks for command lines that do not explicitly mention "powershell" or "pwsh" in their names. This helps in identifying renamed versions of PowerShell.
- It specifically searches for command lines that include certain PowerShell parameters or commands that are commonly used in attacks:
  - -NoProfile: This parameter is used to start PowerShell without loading the user's profile, which can be a tactic to avoid detection.
  - -ExecutionPolicy: This parameter is used to bypass or modify the script execution policy, potentially allowing malicious scripts to run.
  - Invoke-Expression: This command is often used to execute strings as commands, which can be leveraged for executing malicious code.
Output:
- The query projects (or selects) specific fields to display in the results: the device name, file name, action type, original file name of the process, the command line that was executed, and the remote session IP address if applicable.

In summary, this query helps security analysts detect suspicious activity by identifying when PowerShell is being used in a potentially harmful way, especially when its executable has been renamed to avoid detection.

KQL Search