Alternate PowerShell Hosts - PowerShell Module

{
  "ps_module": {
    "EventID": 4103,
    "Channel": [
      "Microsoft-Windows-PowerShell/Operational",
      "PowerShellCore/Operational"
    ]
  },
  "selection": {
    "ContextInfo
| contains": "*"
  },
  "filter_powershell": {
    "ContextInfo
| contains": [
      "= powershell",
      "= C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "= C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell",
      "= C:/Windows/System32/WindowsPowerShell/v1.0/powershell",
      "= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell",
      "= \\\\\\?\\?\\C:Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "= \\\\\\?\\?\\C:Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell"
    ]
  },
  "filter_sdiagnhost": {
    "ContextInfo
| contains": "= C:\\WINDOWS\\System32\\sdiagnhost.exe -Embedding"
  },
  "filter_citrix": {
    "ContextInfo
| contains": "ConfigSyncRun.exe"
  },
  "filter_adace": {
    "ContextInfo
| contains": "C:\\Windows\\system32\\dsac.exe"
  },
  "filter_winrm": {
    "ContextInfo
| contains": "C:\\Windows\\system32\\wsmprovhost.exe -Embedding"
  },
  "filter_help_update": {
    "Payload
| contains": [
      "Update-Help",
      "Failed to update Help for the module"
    ]
  },
  "condition": "ps_module and (selection and not 1 of filter_*)"
}

False Positives

• ⚠ Programs using PowerShell directly without invocation of a dedicated interpreter
• ⚠ MSP Detection Searcher
• ⚠ Citrix ConfigSync.ps1