Sunturai
Back to results
InformationalSplunk security contentRaven Tait +1

Windows PowerShell Script TabExpansion Direct Call

Detects specific indicators associated with the execution of the TabExpansion internal function in PowerShell. Calling this function directly is not normal and can be indicative of malicious activity such as…

Description

Detects specific indicators associated with the execution of the TabExpansion internal function in PowerShell. Calling this function directly is not normal and can be indicative of malicious activity such as TabShell. Due to the way PowerShell internals work it can be used in conjunction with directory transversal to load any PowerShell functions even in a sandboxed session. False positives could include legitimate usage of the TabExpansion function but calling it directly is very rare.

Detection logic

Detection requirements

Platform
LinuxmacOSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
powershell_script_block_logging_4104

Known benign triggers

  • Legitimate use of the TabExpansion function is rare but possible. Filter alerts if direct calls are from trusted administrative or development activities.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice