Windows PowerShell XML Document Load Used for Execution

Flags PowerShell script blocks that use XML document loading combined with expression/command execution keywords.

FreeReviewedSigma · Medium · v2

Product: windows
Category: ps_script
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2022-01-19
Updated: 2026-07-31

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block content that creates a System.Xml.XmlDocument and calls .Load, indicating XML parsing/loading from within PowerShell. It also looks for common PowerShell execution patterns such as IEX (Invoke-Expression), Invoke-Command, or ICM (-), which can be used to run attacker-controlled content. The detection relies on ScriptBlockText telemetry from PowerShell script block logging to match the relevant command and method strings.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Suspicious PsExec Service Launching Encoded PowerShell Payload

Suspicious PowerShell Remote Script Execution via IEX DownloadString

Malicious SharePoint ToolShell Post-Exploitation via Encoded PowerShell (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious Qilin Chrome Credential Harvesting Script Execution via IPScanner (via process_creation)

Suspicious Hidden PowerShell Spawned by Script Host via process_creation

Suspicious Run Key Persistence Referencing PowerShell Script via registry_set

Malicious FIN7 Powertrash Loader Execution via Obfuscated PowerShell (via process_creation)

Suspicious XOR Obfuscated PowerShell from ClickFix Distribution

Windows PowerShell XML Document Load Used for Execution

Pivot detection · T1059.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-script-block-abuse-via-system-xml-xmldocument-load-6c6c6282

title: Windows PowerShell XML Document Load Used for Execution
id: f4ff29b8-78de-45af-ad76-e17590be984a
status: test
description: This rule flags PowerShell script block content that creates a System.Xml.XmlDocument and calls .Load, indicating XML parsing/loading from within PowerShell. It also looks for common PowerShell execution patterns such as IEX (Invoke-Expression), Invoke-Command, or ICM (-), which can be used to run attacker-controlled content. The detection relies on ScriptBlockText telemetry from PowerShell script block logging to match the relevant command and method strings.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-8---powershell-xml-requests
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_xml_iex.yml
author: frack113, Huntrule Team
date: 2022-01-19
modified: 2023-01-19
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_xml:
    ScriptBlockText|contains|all:
      - New-Object
      - System.Xml.XmlDocument
      - .Load
  selection_exec:
    ScriptBlockText|contains:
      - "IEX "
      - "Invoke-Expression "
      - "Invoke-Command "
      - ICM -
  condition: all of selection_*
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: 6c6c6282-7671-4fe9-a0ce-a2dcebdc342b
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL