BIOC
Informational
✕
PowerShell calling Invoke-Expression argument
These PowerShell arguments are often used to run commands with malicious intent.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: PowerShell (T1059.001)
Indicator:
Process action type = execution AND target process cmd = *iex * , *invoke-expression * AND target process name = powershell.exe AND process execution signature = Signed AND process execution signer = *Microsoft Corporation* Host host os = windows
Preventable: yes