Windows PowerShell Import-Module Cmdlet Execution
Flags PowerShell command lines containing Import-Module, indicating module loading into the current session.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-09
- Updated
- 2026-07-31
What it detects
This rule flags process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains the Import-Module cmdlet (including the ipmo alias) to add cmdlets to the current session. Attackers commonly use module import to load additional functionality during execution, which can enable further post-compromise actions. The detection relies on Windows process creation telemetry with executable path (image) and full command-line text, and excludes likely developer/terminal contexts to reduce noise.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-7.3
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-5.1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_import_module.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell Import-Module Cmdlet Execution
id: 5cd7963a-f33d-4871-bdcc-29d66a596dd6
status: test
description: This rule flags process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains the Import-Module cmdlet (including the ipmo alias) to add cmdlets to the current session. Attackers commonly use module import to load additional functionality during execution, which can enable further post-compromise actions. The detection relies on Windows process creation telemetry with executable path (image) and full command-line text, and excludes likely developer/terminal contexts to reduce noise.
references:
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-7.3
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/import-module?view=powershell-5.1
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_import_module.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-09
modified: 2023-12-01
tags:
- attack.execution
- detection.threat-hunting
logsource:
product: windows
category: process_creation
detection:
selection_img:
- Image|endswith:
- \powershell.exe
- \pwsh.exe
- OriginalFileName:
- PowerShell.EXE
- pwsh.dll
selection_cmdlet:
CommandLine|contains:
- "Import-Module "
- "ipmo "
filter_main_vsstudio:
ParentImage|contains:
- :\Program Files\WindowsApps\Microsoft.WindowsTerminal_
- :\Windows\System32\cmd.exe
CommandLine|contains|all:
- :\Program Files\Microsoft Visual Studio\
- Tools\Microsoft.VisualStudio.DevShell.dll
condition: all of selection_* and not 1 of filter_main_*
falsepositives:
- Depending on the environement, many legitimate scripts will import modules inline. This rule is targeted for hunting purposes.
level: low
license: DRL-1.1
related:
- id: 4ad74d01-f48c-42d0-b88c-b31efa4d2262
type: derived