name: malicious_powershell_strings
date: 2025-05-05
version: 3
id: d2fcf9eb-c7a4-4b05-9db4-99c6430d0513
author: Steven Dick, Raven Tait
lookup_type: csv
description: A list of commands and commandlets used with known malicious powershell tooling.
match_type:
- WILDCARD(command)
min_matches: 1
max_matches: 1
case_sensitive_match: false