Skip to content

Hide Navigation Hide TOC

Renamed Powershell Under Powershell Channel (30a8cb77-8eb3-4cfb-8e79-ad457c5a4592)

Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.

Cluster A Galaxy A Cluster B Galaxy B Level
Rename System Utilities - T1036.003 (bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b) Attack Pattern Renamed Powershell Under Powershell Channel (30a8cb77-8eb3-4cfb-8e79-ad457c5a4592) Sigma-Rules 1
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Renamed Powershell Under Powershell Channel (30a8cb77-8eb3-4cfb-8e79-ad457c5a4592) Sigma-Rules 1
Rename System Utilities - T1036.003 (bd5b58a4-a52d-4a29-bc0d-3f1d3968eb6b) Attack Pattern Masquerading - T1036 (42e8de7b-37b2-4258-905a-6897815e58e0) Attack Pattern 2
PowerShell - T1059.001 (970a3432-3237-47ad-bcca-7d8cbb217736) Attack Pattern Command and Scripting Interpreter - T1059 (7385dfaf-6886-4229-9ecd-6fd678040830) Attack Pattern 2