← Back to SOC feed Coverage →

Generic PowerShell Malware Rule

yara LOW Yara-Rules
communitypowershell
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-12T23:00:00Z · Confidence: medium

Hunt Hypothesis

Adversaries may use PowerShell to execute malicious scripts, leveraging its commonality and integration with Azure environments to evade detection. SOC teams should proactively hunt for this behavior to identify potential malware activity that may bypass traditional detection mechanisms.

YARA Rule

rule GEN_PowerShell 
{

    meta:
        description = "Generic PowerShell Malware Rule"
        author = "https://github.com/interleaved"
    
    strings:
        $s1 = "powershell"
        $s2 = "-ep bypass" nocase
        $s3 = "-nop" nocase
        $s10 = "-executionpolicy bypass" nocase
        $s4 = "-win hidden" nocase
        $s5 = "-windowstyle hidden" nocase
        $s11 = "-w hidden" nocase
        /*$s6 = "-noni" fullword ascii*/
        /*$s7 = "-noninteractive" fullword ascii*/
        $s8 = "-enc" nocase
        $s9 = "-encodedcommand" nocase
    
    condition:
        $s1 and (($s2 or $s3 or $s10) and ($s4 or $s5 or $s11) and ($s8 or $s9))
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 11 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/GEN_PowerShell.yar