PowerShell Get-Alias or Get-Command with Suspicious Parameters

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects PowerShell processes executing with command-line arguments that suggest the use of 'Get-Alias' (gal) or 'Get-Command' (gcm) followed by suspicious patterns. This could indicate an adversary attempting to discover system capabilities or installed modules.