powershell_ise.exe
Summary
PowerShell Integrated Scripting Environment. GUI editor and debugger for PowerShell scripts. Has the same script execution capabilities as powershell.exe but may evade detections that only monitor the standard PowerShell process.
powershell_ise.exe is the 2667th most commonly executed Windows program in EchoTrail's dataset, observed 141 times across enterprise environments. It typically runs from C:\Windows\System32\WindowsPowerShell\v1.0 and it is most often launched by explorer.exe.
Behavior
Top Paths
- C:\Windows\System32\WindowsPowerShell\v1.0100%
Top Hashes (SHA256)
- 1172951d8b1aa4cf9d0ac9f72ae344c5896ce4286c790a1f0dff8a6f71a5772e60.87%
- df54cbe8ad814ae09766f3cdb5c3bca9bd407621211daa23194e58533837d2e013.04%
- 8cfac3f204df864a5e9d9e20a4e7d4d70cb30a146661d0f7447a927be74f7f046.52%
- 40778fe0ea2535ba2bd03d2b5cc0946b8a244a3fd752056428b8e51c9f5a90a35.8%
- 54fae2d27426f0a19f0e0b0289d4725e363a6d1078a2df501260870fa8d47dde5.8%
- 9f0aa70533741d0b9ca0d23bdf8c6b509844e9ec1776b442a9c0dcf2d99b00bb2.9%
- c2e227a3a9668d651c9f7af5b27c4fc198f4d043d951e6ec100bedc5497942f72.17%
- 6cbcd7e7544c5878c07382499440c4878b5da4c8b2c64bc9d81f1a2686330b0f1.45%
- 25e55b99a70f6ab09c49cf9f8a2aab2cccb283143890445880bc604b7baef73c0.72%
- b6920f058d15ee44afc54625e67aaf206ca791b4fe4babd53e0bb209da256c3c0.72%
Process Ancestry
Top Grandparents
- userinit.exe72%
- svchost.exe20%
- cmd.exe4%
Top Parents
- explorer.exe92.91%
- RuntimeBroker.exe5.67%
- cmd.exe0.71%
- powershell.exe0.71%
Top Children
- netsh.exe34.84%
- find.exe33.55%
- net.exe5.16%
- powershell.exe5.16%
- conhost.exe3.87%
- findstr.exe3.23%
- cmd.exe1.94%
- csc.exe1.29%
- auditpol.exe0.65%
- certutil.exe0.65%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does powershell_ise.exe normally do?
Runs from C:\Windows\System32\WindowsPowerShell\v1.0\. GUI application used by administrators and developers to write/debug PowerShell scripts. Less common than powershell.exe in production environments.
When is powershell_ise.exe suspicious?
Launched by cmd.exe or other shells rather than explorer.exe. Running on servers (unusual — ISE is a desktop tool). Spawning network connections. Loading scripts from temp directories.
How do attackers abuse powershell_ise.exe?
DETECTION BYPASS: Some EDR and SIEM rules specifically monitor powershell.exe but not powershell_ise.exe. Attackers can use ISE to execute the same PowerShell commands with less detection coverage. ISE supports the same cmdlets, modules, and .NET access as standard PowerShell. ISE can also be used to edit and execute scripts interactively, making it harder to capture command-line arguments in process creation logs (commands are typed into the GUI, not passed as arguments).
Detection guidance
Apply the same detection logic to powershell_ise.exe as powershell.exe: - Script block logging (Event ID 4104) captures commands regardless of host - Module logging captures cmdlet invocations - Monitor for unexpected ISE execution on servers DATA SOURCES: PowerShell script block logging (4104), module logging (4103), process creation (Sysmon 1)
False positive notes
Common on developer and admin workstations for script development. Some training environments use ISE for PowerShell courses.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about powershell_ise.exe
Rocky answers questions about powershell_ise.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.