powershell_ise.exe

File Path: C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe
Description: Windows PowerShell ISE

Screenshot

powershell_ise.exe

Hashes

Type	Hash
MD5	`30A2792A2428CD06CFEC23ECB074889A`
SHA1	`C7C8939C7780E8E68AC303E6B1ABD69892CA39A0`
SHA256	`6CBCD7E7544C5878C07382499440C4878B5DA4C8B2C64BC9D81F1A2686330B0F`
SHA384	`BCF8D75E3E188E9688DBA441C7FC7829FB9C6136261D9B6DD66BBEACB1AE435A50853DB0B5186816AF27B422BAA7448B`
SHA512	`F253CB4B5E155BC4A8C1190971167219FB229C83F901AEF948F59B4030D3C5247FFC78BCC2C9C062AA98E37970BF54F8A09435A618DDEC3EC2F8E166A7B812AC`
SSDEEP	`3072:19kVjGPsw403LkVjqP4w6U+ToIuWNXmmZTWl/jC7gDooMLEY:TkkuZToIuUXmmZbgDooMD`

Signature

Status: Signature verified.
Serial: 330000023241FB59996DCC4DFF000000000232
Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: powershell_ise.EXE
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.18362.1 (WinBuild.160101.0800)
Product Version: 10.0.18362.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File	Score
C:\WINDOWS\system32\WindowsPowerShell\v1.0\powershell_ise.exe	93
C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe	88
C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe	90
C:\Windows\system32\WindowsPowerShell\v1.0\powershell_ise.exe	91
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	93
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	90
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	90
C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	94
C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe	91

Possible Misuse

The following table contains possible examples of powershell_ise.exe being misused. While powershell_ise.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	image_load_in_memory_powershell.yml	`- '\powershell_ise.exe'`	DRL 1.0
sigma	pipe_created_alternate_powershell_hosts_pipe.yml	`- '\powershell_ise.exe'`	DRL 1.0
sigma	proc_creation_win_renamed_binary.yml	`- 'powershell_ise.exe'`	DRL 1.0
sigma	proc_creation_win_renamed_binary.yml	`- '\powershell_ise.exe'`	DRL 1.0
sigma	proc_creation_win_renamed_binary_highly_relevant.yml	`- 'powershell_ise.exe'`	DRL 1.0
sigma	proc_creation_win_renamed_binary_highly_relevant.yml	`- '\powershell_ise.exe'`	DRL 1.0
sigma	proc_creation_win_renamed_powershell.yml	`- '\powershell_ise.exe'`	DRL 1.0
sigma	proc_creation_win_susp_bitstransfer.yml	`- '\powershell_ise.exe'`	DRL 1.0
atomic-red-team	T1059.001.md	1. Open Powershell_ise as a Privileged Account	MIT License. © 2018 Red Canary

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

PowerShell_ise

Windows PowerShell Integrated Scripting Environment (ISE) is a graphical host application that enables you to read, write, run, debug, and test scripts and modules in a graphic-assisted environment. Key features such as IntelliSense, Show-Command, snippets, tab completion, syntax-coloring, visual debugging, and context-sensitive Help provide a rich scripting experience.

Using PowerShell.exe

The PowerShell_ISE.exe tool starts a Windows PowerShell ISE session. When you use PowerShell_ISE.exe, you can use its optional parameters to open files in Windows PowerShell ISE or to start a Windows PowerShell ISE session with no profile or with a multithreaded apartment.

To start a Windows PowerShell ISE session in a Command Prompt window, in Windows PowerShell, or at the Start menu, type:
```
PowerShell_Ise.exe
```
To open a script (.ps1), script module (.psm1), module manifest (.psd1), XML file, or any other supported file in Windows PowerShell ISE, type:
```
PowerShell_Ise.exe <filepath>
```
In Windows PowerShell 3.0, you can use the optional File parameter as follows:
```
PowerShell_Ise.exe -file <filepath>
```
To start a Windows PowerShell ISE session without your Windows PowerShell profiles, use the NoProfile parameter. (The NoProfile parameter is introduced in Windows PowerShell 3.0.), type:
```
PowerShell_Ise.exe -NoProfile
```

To see the PowerShell_ISE.exe help file, type:

  PowerShell_Ise.exe -help
  PowerShell_Ise.exe -?
  PowerShell_Ise.exe /?

Remarks

For a complete list of the PowerShell_ISE.exe command-line parameters, see about_PowerShell_Ise.Exe.
For information about other ways to start Windows PowerShell, see Starting Windows PowerShell.
Windows PowerShell runs on the Server Core installation option of Windows Server operating systems. However, because Windows PowerShell ISE requires a graphic user interface, it does not run on Server Core installations.

Additional References

about_PowerShell_Ise.exe