Permalink
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
28 lines (26 sloc) 647 Bytes
title: Suspicious PowerShell Invocations - Generic
status: experimental
description: Detects suspicious PowerShell invocation command parameters
tags:
- attack.execution
- attack.t1086
author: Florian Roth (rule)
logsource:
product: windows
service: powershell
detection:
encoded:
- ' -enc '
- ' -EncodedCommand '
hidden:
- ' -w hidden '
- ' -window hidden '
- ' - windowstyle hidden '
noninteractive:
- ' -noni '
- ' -noninteractive '
condition: all of them
falsepositives:
- Penetration tests
- Very special / sneaky PowerShell scripts
level: high