pwsh.exe
Summary
PowerShell Core (cross-platform). The modern, open-source PowerShell built on .NET Core/5+. Has the same capabilities as Windows PowerShell but runs cross-platform. May evade detections that only monitor the legacy powershell.exe.
pwsh.exe is the 2762nd most commonly executed Windows program in EchoTrail's dataset, observed 124 times across enterprise environments. It typically runs from C:\Program Files\PowerShell\7 and it is most often launched by WindowsTerminal.exe.
Behavior
Top Paths
- C:\Program Files\PowerShell\795.16%
- C:\Program Files\WindowsApps\Microsoft.PowerShell_7.3.6.0_x64__8wekyb3d8bbwe4.84%
Top Hashes (SHA256)
- 5d86853fdd0a604bdda0ee803e938b5975b7b7336733b788af5c29aa236793ea54.84%
- c22f0b35f7f635ddc57a71854acb1e40f18ddb646486260090415a9b46a4194d23.39%
- cb3ff5fc3c0dc36bdad904c51c65c44e50598eafff7f5ef53f28c9649fd65ebc9.68%
- 3d9413467ae5a492bd8c809804d61699c503730df8e9464f989e39ada445566b6.45%
- ca7ae9cf3f76a15094251cec06b451cb312a0beecc13623c2a54b1e3d04c84d24.03%
- 546673e5379b23e7f5e0159d9332210ef6901837da5bfbd516249c57530cc1050.81%
- 654176a362801dd426f3f913305ebbe6bacbaf05f21777e4ee6c57039dd076360.81%
Process Ancestry
Top Parents
- WindowsTerminal.exe54.03%
- explorer.exe22.58%
- Code.exe17.74%
- msiexec.exe5.65%
Top Children
- ssh.exe26.06%
- python.exe21.81%
- nslookup.exe9.57%
- PING.EXE6.91%
- wsl.exe6.38%
- wevtutil.exe3.72%
- systeminfo.exe2.66%
- find.exe1.6%
- powershell.exe1.6%
- ipconfig.exe1.06%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does pwsh.exe normally do?
Installed separately from Windows PowerShell (not included by default). Runs from C:\Program Files\PowerShell\7\ (or similar version path). Used by administrators who prefer the modern PowerShell experience. Growing adoption in enterprise environments.
When is pwsh.exe suspicious?
Same indicators as powershell.exe — encoded commands (-EncodedCommand), download cradles (IWR, IEX), AMSI bypass attempts, execution policy bypass (-ep bypass). Additionally: pwsh.exe present on systems where it wasn't intentionally installed.
How do attackers abuse pwsh.exe?
DETECTION BYPASS: Many organizations have extensive PowerShell (powershell.exe) monitoring but haven't extended coverage to pwsh.exe. Attackers install or use pre-installed pwsh.exe to execute the same attacks with less visibility. All standard PowerShell attack techniques work in pwsh.exe: download cradles, AMSI bypass, credential harvesting, AD enumeration, reverse shells. Script block logging may not be configured for PowerShell Core if the organization only configured it for Windows PowerShell.
Detection guidance
Extend ALL powershell.exe detection rules to also cover pwsh.exe: - Script block logging for PowerShell Core (separate configuration from Windows PowerShell) - Process creation monitoring for pwsh.exe with the same command-line analysis - Module logging for PowerShell Core - Monitor for pwsh.exe installation events on systems that shouldn't have it DATA SOURCES: PowerShell Core script block logging, process creation (Sysmon 1)
False positive notes
Growing legitimate use as organizations adopt PowerShell 7+. Azure Cloud Shell uses pwsh. DevOps pipelines increasingly use pwsh for cross-platform compatibility.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about pwsh.exe
Rocky answers questions about pwsh.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.