PowerShell One-Liner Credential Pattern Search

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects PowerShell or pwsh one-liners whose command line combines a regex or string-matching primitive with common credential-related keywords. It might indicate an attempt of credential harvesting across local files, including config files, source code, chat history, etc. looking for secrets such as API keys, tokens, passwords, or SSH keys.

2026-06-11 00:00:00

None

837493bb-8c67-49f2-99ba-1deb97db22da

attack.credential-access attack.t1552.001

Nextron Sigma feed only (private)