ByteRay CQL Hub
← All queries

Suspicious PowerShell Execution

This query identifies suspicious PowerShell execution patterns, including encoded commands and unusual parent processes, which could indicate malicious activity.

CQL · Falcon Next-Gen SIEMCopy query
#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i
| CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i
| join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])
| table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine])

This query uses CrowdStrike Query Language (CQL) to detect suspicious PowerShell activity:

  1. Event Filtering: #event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i - Searches ProcessRollup2 events for any PowerShell executable (case-insensitive)

  2. Command Line Analysis: CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i - Uses regex to find encoded command parameters (-EncodedCommand, -enc, etc.)

  3. User Context: join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName]) - Enriches results with username information

  4. Output: table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine]) - Displays key fields for analysis

Suspicious_PowerShell_Execution.yml
T1059.001, T1070.005
ByteRay GmbH
Hunting
Endpoint
Insight
2025-08-04
2025-08-26

Get this query running in your SIEM, with someone on call.

Our Managed SIEM team operates CrowdStrike Falcon Next-Gen SIEM in production, with over 350 battle-tested use cases and 24/7 incident response behind them.

Talk to the SIEM team