Real-time monitoring identifies direct PowerShell execution or indirect System.Management.Automation use with an unexpected parent, encoded/obfuscated arguments, unusual module loading, or execution followed by OT-relevant network/process activity. Alert only when the interpreter is not part of the asset's approved software/automation baseline or its execution context violates an approved signer/hash/path/parent/user rule, and require OT-relevant corroboration such as access to engineering files, ICS software/API use, communications with protected OT assets, configuration change, or another suspicious follow-on behavior. Suppress documented vendor software, engineering workflows, diagnostics, backup, patching, and approved maintenance.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | WinEventLog:Sysmon | EventCode=1; powershell/pwsh or suspicious parent-child chain |
| Command Execution (DC0064) | WinEventLog:PowerShell | EventCode=4103/4104/4105/4106; command/script-block content |
| Process Metadata (DC0034) | WinEventLog:PowerShell | EventCode=400/403; engine lifecycle/context |
| Module Load (DC0016) | WinEventLog:Sysmon | EventCode=7; System.Management.Automation or unusual PowerShell-related modules |
| Field | Description |
|---|---|
| ApprovedPowerShellUse | Approved scripts, modules, hosts, service accounts, and vendor workflows |
| ParentProcessName | Expected parents for engineering/administrative PowerShell |
| CommandLinePattern | Encoded, hidden, download, reflection, remoting, or ICS/API-related arguments |
| MaintenanceWindow | Approved change/diagnostic periods |
| ProtectedOTDestinations | Controllers, HMIs, historians, gateways, and engineering assets where follow-on activity raises fidelity |