powershell_ise.exe
Sources: 300M+ executions observed in the wild.
Summary
PowerShell Integrated Scripting Environment. GUI editor and debugger for PowerShell scripts. Has the same script execution capabilities as powershell.exe but may evade detections that only monitor the standard PowerShell process.
powershell_ise.exe is the 2667th most commonly executed Windows program in EchoTrail's dataset, observed 141 times across enterprise environments. It typically runs from C:\Windows\System32\WindowsPowerShell\v1.0 and it is most often launched by explorer.exe.
Get this in your tools
The same record for powershell_ise.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/powershell_ise.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System32\WindowsPowerShell\v1.0100%
Top Hashes (SHA256)
- 1172951d8b1aa4cf9d0ac9f72ae344c5896ce4286c790a1f0dff8a6f71a5772e60.87%
- df54cbe8ad814ae09766f3cdb5c3bca9bd407621211daa23194e58533837d2e013.04%
- 8cfac3f204df864a5e9d9e20a4e7d4d70cb30a146661d0f7447a927be74f7f046.52%
- 40778fe0ea2535ba2bd03d2b5cc0946b8a244a3fd752056428b8e51c9f5a90a35.8%
- 54fae2d27426f0a19f0e0b0289d4725e363a6d1078a2df501260870fa8d47dde5.8%
- 9f0aa70533741d0b9ca0d23bdf8c6b509844e9ec1776b442a9c0dcf2d99b00bb2.9%
- c2e227a3a9668d651c9f7af5b27c4fc198f4d043d951e6ec100bedc5497942f72.17%
- 6cbcd7e7544c5878c07382499440c4878b5da4c8b2c64bc9d81f1a2686330b0f1.45%
- 25e55b99a70f6ab09c49cf9f8a2aab2cccb283143890445880bc604b7baef73c0.72%
- b6920f058d15ee44afc54625e67aaf206ca791b4fe4babd53e0bb209da256c3c0.72%
Process Ancestry
Top Grandparents
- userinit.exe72%
- svchost.exe20%
- cmd.exe4%
Top Parents
- explorer.exe92.91%
- RuntimeBroker.exe5.67%
- cmd.exe0.71%
- powershell.exe0.71%
Top Children
- netsh.exe34.84%
- find.exe33.55%
- net.exe5.16%
- powershell.exe5.16%
- conhost.exe3.87%
- findstr.exe3.23%
- cmd.exe1.94%
- csc.exe1.29%
- auditpol.exe0.65%
- certutil.exe0.65%
Security Analysis
What does powershell_ise.exe normally do?
Runs from C:\Windows\System32\WindowsPowerShell\v1.0\. GUI application used by administrators and developers to write/debug PowerShell scripts. Less common than powershell.exe in production environments.
When is powershell_ise.exe suspicious?
Launched by cmd.exe or other shells rather than explorer.exe. Running on servers (unusual — ISE is a desktop tool). Spawning network connections. Loading scripts from temp directories.
How do attackers abuse powershell_ise.exe?
DETECTION BYPASS: Some EDR and SIEM rules specifically monitor powershell.exe but not powershell_ise.exe. Attackers can use ISE to execute the same PowerShell commands with less detection coverage. ISE supports the same cmdlets, modules, and .NET access as standard PowerShell. ISE can also be used to edit and execute scripts interactively, making it harder to capture command-line arguments in process creation logs (commands are typed into the GUI, not passed as arguments).
Detection guidance
Apply the same detection logic to powershell_ise.exe as powershell.exe: - Script block logging (Event ID 4104) captures commands regardless of host - Module logging captures cmdlet invocations - Monitor for unexpected ISE execution on servers DATA SOURCES: PowerShell script block logging (4104), module logging (4103), process creation (Sysmon 1)
False positive notes
Common on developer and admin workstations for script development. Some training environments use ISE for PowerShell courses.
MITRE ATT&CK techniques
Related Processes
Ask Rocky about powershell_ise.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for powershell_ise.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.