https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-powershell-command/m-p/1240418#M8818 <P>Hello everyone!<BR />I received an alert about PowerShell with the DCsync rule.<BR />I'd like to check if I can see the code that PowerShell executed.</P> <P>I can only see the "PowerShell_ise.exe" process. I don't know what code or command generated the alert.</P> <P>&nbsp;</P> <P>There is a possibility that it is a script code, but I would like to identify it better.</P> Tue, 21 Oct 2025 17:41:50 GMT EMARTINS BERNARDES 2025-10-21T17:41:50Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-powershell-command/m-p/1240418#M8818 <P>Hello everyone!<BR />I received an alert about PowerShell with the DCsync rule.<BR />I'd like to check if I can see the code that PowerShell executed.</P> <P>I can only see the "PowerShell_ise.exe" process. I don't know what code or command generated the alert.</P> <P>&nbsp;</P> <P>There is a possibility that it is a script code, but I would like to identify it better.</P> Tue, 21 Oct 2025 17:41:50 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-powershell-command/m-p/1240418#M8818 EMARTINS BERNARDES 2025-10-21T17:41:50Z https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-powershell-command/m-p/1240421#M8819 <P>Check the following fields using XQL:&nbsp;action_evtlog_data_fields,&nbsp;dynamic_event_string_map</P> Tue, 21 Oct 2025 18:20:46 GMT https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/monitoring-powershell-command/m-p/1240421#M8819 ChrisDavila 2025-10-21T18:20:46Z