Rule Info
Name
Suspicious PowerShell Get-Command Execution With Glob Patterns
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects execution of obfuscated variations of PowerShell Get-Command using glob patterns (wildcards or character ranges), potentially used for command obfuscation and evasion
Date
2026-03-04 00:00:00
Modified
None
Id
8f3c2b1a-4d5e-6f7a-8b9c-0d1e2f3a4b5c
Tags
attack.execution attack.defense-evasion attack.t1059.001 attack.t1027.010
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR