Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and…

T1059.001 Command and Scripting Interpreter: PowerShell - Suspicious Engine Start Arguments

title: "T1059.001 Command and Scripting Interpreter: PowerShell - Suspicious Engine Start Arguments"
id: 1fca4271-82a8-4bf4-a401-10df0163f014
status: test
description: 'Detects the PowerShell engine starting (classic PowerShell log, Event 400/403) with a HostApplication command line containing common obfuscation/bypass flags. Matches the real SigmaHQ convention of matching against the raw Data field, since the classic PowerShell log is an unstructured message rather than discrete parsed fields.'
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Shahrukh Khan
date: 2026-07-10
license: MIT
tags:
  - attack.execution
  - attack.t1059.001

logsource:
  product: windows
  service: powershell-classic

detection:
  selection:
    Data|contains: 'HostApplication='

  suspicious:
    Data|contains:
      - '-enc'
      - '-nop'
      - '-w hidden'
      - '-windowstyle hidden'
      - 'bypass'

  condition: selection and suspicious

falsepositives:
  - Legitimate scripts/scheduled tasks that pass -nop/-w hidden for non-interactive automation

level: medium

T1059.001 — PowerShell

Sigma detection rules (1)

T1059.001 Command and Scripting Interpreter: PowerShell - Suspicious Engine Start Arguments

Related sub-techniques

Explore