detecting-suspicious-powershell-execution

name	detecting-suspicious-powershell-execution
description	Hunt for suspicious PowerShell execution (T1059.001) such as encoded commands, download cradles, AMSI bypass, and constrained language mode evasion using EDR telemetry (CrowdStrike, Microsoft Defender for Endpoint), Sysmon, and SIEM queries (Splunk, Elastic). Use when proactively threat hunting, triaging EDR/SIEM alerts, or scoping an incident involving malicious PowerShell activity.
domain	cybersecurity
subdomain	threat-hunting
tags	["threat-hunting","mitre-attack","powershell","execution","t1059","amsi","proactive-detection"]
version	1.0
author	mahipal
license