ConceptsPowerShell Detection

PowerShell Detection

Detecting malicious PowerShell use through behavioral signals like encoded commands, suspicious script content, unusual parent processes, and known abuse patterns, often mapped to ATT&CK to catch a heavily abused execution technique.

Glossary definition

8 direct links5 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Endpoint Telemetry

The foundation PowerShell Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Endpoint TelemetryStart here

The activity data collected from endpoints, process creation, file and registry changes, network connections, logons, that feeds detection and investigation. It is one of the richest and most important telemetry sources for defenders.

lessons

Relatedsorted by lesson coverage

Command Line

lessons

Parent Process

lessons

LOLBin Detection

lessons

LSASS Memory Dumping Detection

lessons

MITRE ATT&CK Framework

lessons

HKCU

lessons

Show 1 more connection

Shell

lesson

Related Lessons

5 lessons cover this concept

Build Endpoint Behavior Analytics

SOC Analyst

Use ATT&CK Without Overclaiming Coverage

SOC Analyst

From Hypothesis to Telemetry Contract

SOC Analyst

Correlate Identity, Remote Access, and Network Behavior

SOC Analyst

Engineer Rules, Tuning, and Response Contracts

SOC Analyst