Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines
Alerts on suspicious PowerShell command lines that pipe or otherwise invoke IEX and may include Base64 decoding.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-03-24
- Updated
- 2026-07-30
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where PowerShell (powershell.exe or pwsh.exe) is launched with command-line fragments that invoke IEX, including common pipe-and-iex forms and related IEX variants. Attackers often use IEX to execute dynamically generated or encoded PowerShell code, which can help payloads evade simple script-blocking and static analysis. The detection relies on process creation telemetry, specifically the executable path ending in PowerShell and command-line substrings that match IEX and Base64 decoding building blocks.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2
- huntress.comhttps://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines
id: 1705c248-ca60-45c1-b3c9-cbcc0d1af410
status: test
description: This rule flags Windows process creation events where PowerShell (powershell.exe or pwsh.exe) is launched with command-line fragments that invoke IEX, including common pipe-and-iex forms and related IEX variants. Attackers often use IEX to execute dynamically generated or encoded PowerShell code, which can help payloads evade simple script-blocking and static analysis. The detection relies on process creation telemetry, specifically the executable path ending in PowerShell and command-line substrings that match IEX and Base64 decoding building blocks.
references:
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2
- https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-03-24
modified: 2022-11-28
tags:
- attack.execution
- attack.t1059.001
logsource:
product: windows
category: process_creation
detection:
selection_combined_1:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains:
- " | iex;"
- " | iex "
- " | iex}"
- " | IEX ;"
- " | IEX -Error"
- " | IEX (new"
- ");IEX "
selection_combined_2:
CommandLine|contains:
- ::FromBase64String
- ".GetString([System.Convert]::"
selection_standalone:
CommandLine|contains:
- )|iex;$
- );iex($
- );iex $
- " | IEX | "
- ' | iex\"'
condition: all of selection_combined_* or selection_standalone
falsepositives:
- Legitimate scripts that use IEX
level: high
license: DRL-1.1
related:
- id: 09576804-7a05-458e-a817-eb718ca91f54
type: derived