Windows PowerShell Script TabExpansion Direct Call — Detection Rule
Detects specific indicators associated with the execution of the TabExpansion internal function in PowerShell. Calling this function directly is not normal and can be indicative of malicious activity such as TabShell. Due to the way PowerShell internals work it can be used in conjunction with directory transversal to load any PowerShell functions even in a sandboxed session. False positives could include legitimate usage of the TabExpansion function but calling it directly is very rare.