Identifier / Programs / Linux and Unix
pwsh
Shell and scripting language designed especially for system administration. This command refers to PowerShell version 6 and above (also known as PowerShell Core and cross-platform PowerShell). To use the original Windows version (5.1 and below, also known as the legacy Windows PowerShell), use powershell instead of pwsh. tldr-pages
GTFOBins file-write 1 Sigma rule name it 2 documented commands
How pwsh is abused
file-write
-cEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for pwsh.
2 documented commands
file-write unprivileged, with sudo
pwsh -c '"DATA" | Out-File /path/to/output-file'shell unprivileged, with sudo
pwshNone of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for pwsh. The identifier reads the line of each that runs pwsh.
What detects it
Everyday use
Start an interactive shell session
pwshIdentifyStart an interactive shell session without loading startup configs
pwsh -NoProfileIdentify-NoProfileDoesn't load the PowerShell profile. about_PowerShell_exeExecute specific commands
pwsh -Command "echo 'powershell is executed'"Identify-CommandThe value of Command can be -, a script block, or a string. about_PowerShell_exeNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.