powershell.exe

Top Paths

• C:\Windows\System32\WindowsPowerShell\v1.098.1%
• C:\Windows\SysWOW64\WindowsPowerShell\v1.01.9%

Top Hashes (SHA256)

• 34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea635.04%
• 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f28.16%
• 840e1f9dc5a29bebf01626822d7390251e9cf05bb3560ba7b68bdb8a41cf08e320.69%
• ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa5.15%
• ba4038fd20e474c047be8aad5bfacdb1bfc1ddbe12f803f473b7918d8d8194362.65%
• d3f8fade829d2b7bd596c4504a6dae5c034e789b6a3defbe013bda7d144666772.03%
• a8fdba9df15e41b6f5c69c79f66a26a9d48e174f9e7018a371600b866867dab81.36%
• de96a6e69944335375dc1ac238336066889d9ffc7d73628ef4fe1b1b160ab32c1.2%
• 0bbf1952ee724d29f04d9ea52cae9c8c781791d57ed127ae7b618704c3395a790.99%
• b4e7bc24bf3f5c3da2eb6e9ec5ec10f90099defa91b820f2f3fc70dd9e4785c40.95%

Top Grandparents

• LTSVC.exe97.77%
• services.exe1.47%
• runkbot.exe0.29%
• svchost.exe0.18%
• 32bitProxy.exe0.17%
• Asusgiftbox.exe0.05%
• userinit.exe0.01%
• explorer.exe0.01%
• msiexec.exe<0.01%
• Lenovo.Modern.ImController.exe<0.01%

Top Parents

• cmd.exe77.58%
• jumpcloud-agent.exe13.86%
• platform-scripting-plugin.exe2.29%
• taskeng.exe1.33%
• QualysAgent.exe1.3%
• svchost.exe0.85%
• CcmExec.exe0.7%
• EXECUT~1.EXE0.59%
• generic-asset-interrogator.exe0.33%
• CompatTelRunner.exe0.3%

Top Children

• conhost.exe53.88%
• WMIC.exe13.21%
• jcosqueryi.exe8.49%
• sc.exe6.46%
• netsh.exe4.07%
• findstr.exe2.15%
• wscript.exe2.06%
• mode.com2.06%
• gpupdate.exe1.94%
• DismHost.exe1.5%

What does powershell.exe normally do?

Located in C:\Windows\System32\WindowsPowerShell\v1.0 (64-bit) or C:\Windows\SysWOW64\WindowsPowerShell\v1.0 (32-bit). Parent processes vary — commonly launched by cmd.exe, management agents (JumpCloud, Qualys, SCCM), taskeng.exe, svchost.exe, and explorer.exe (interactive). Common children include conhost.exe, wmic.exe, sc.exe, netsh.exe, and various management tools.

When is powershell.exe suspicious?

Command-line containing -EncodedCommand (-enc), -WindowStyle Hidden, -ExecutionPolicy Bypass, -NoProfile -NonInteractive combined together. Downloading content via Net.WebClient, Invoke-WebRequest, or Invoke-Expression (IEX). Spawned by Office applications (winword.exe, excel.exe), w3wp.exe, or mshta.exe. Using reflection or direct .NET assembly loading. Base64-encoded command-line arguments. Running from a non-standard path.

How do attackers abuse powershell.exe?

One of the most commonly abused LOLBins due to its power and ubiquity. Attackers use it for download cradles (download and execute payloads in memory), credential dumping via script-based tools, lateral movement, persistence via scheduled tasks or registry modification, and data exfiltration. Obfuscation techniques include string concatenation, variable substitution, tick-mark insertion, and encoding to evade command-line detection. PowerShell without powershell.exe (BYOE): attackers can host the PowerShell runtime in custom executables using System.Management.Automation to avoid process-name-based detections.

Detection guidance

Enable PowerShell ScriptBlock Logging (Event ID 4104) and Module Logging — these capture the deobfuscated script content regardless of command-line obfuscation. Monitor for Event ID 4103 (pipeline execution). High-confidence: powershell.exe spawned by Office applications or w3wp.exe. Medium-confidence: -EncodedCommand with -WindowStyle Hidden. Monitor for PowerShell Constrained Language Mode bypasses. For AMSI bypass attempts, look for patterns like "AmsiUtils" or "amsiInitFailed" in script block logs.

False positive notes

Extremely common in legitimate administration. Management agents frequently run PowerShell scripts with -ExecutionPolicy Bypass. Scheduled tasks and GPO scripts commonly use -NonInteractive and -NoProfile. Some legitimate software uses -EncodedCommand for scripts containing special characters. Focus on parent process context and script content rather than individual flags.

MITRE ATT&CK techniques