Powershell on Matt Swann — Detection Engineering & Threat Intel

Powershell on Matt Swann — Detection Engineering & Threat Intelhttp://mattswann.dev/tags/powershell/Recent content in Powershell on Matt Swann — Detection Engineering & Threat IntelHugoen-usTue, 07 Jul 2026 09:00:00 -0600Detection Deep Dive: Encoded PowerShell Commands (T1059.001)http://mattswann.dev/posts/detection-deep-dive-encoded-powershell/Tue, 07 Jul 2026 09:00:00 -0600http://mattswann.dev/posts/detection-deep-dive-encoded-powershell/The first entry in the Detection Deep Dive series: mapping encoded PowerShell execution to detection logic in Microsoft Defender, tuning out the false positives, and knowing what the detection can’t see.