rules/windows/deprecated/powershell_suspicious_invocation_generic.yml

title: Suspicious PowerShell Invocations - Generic
id: 3d304fda-78aa-43ed-975c-d740798a49c1
status: deprecated
description: Detects suspicious PowerShell invocation command parameters
tags:
    - attack.execution
    - attack.t1059.001
author: Florian Roth (rule)
date: 2017/03/12
modified: 2021/12/02
logsource:
    product: windows
    service: powershell
detection:
    selection_encoded:
        - ' -enc '
        - ' -EncodedCommand '
    selection_hidden:
        - ' -w hidden '
        - ' -window hidden '
        - ' -windowstyle hidden '
    selection_noninteractive:
        - ' -noni '
        - ' -noninteractive '
    condition: all of selection*
falsepositives:
    - Very special / sneaky PowerShell scripts
level: high
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`title: Suspicious PowerShell Invocations - Generic`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: 3d304fda-78aa-43ed-975c-d740798a49c1`
$frack113$ Add deprecated status 2021-10-28 20:08:27 +02:00			`status: deprecated`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`description: Detects suspicious PowerShell invocation command parameters`
Tagged windows powershell, other and malware rules. 2018-07-24 10:56:41 +02:00			`tags:`
			`- attack.execution`
Initial round of subtechnique updates 2020-06-16 14:46:08 -06:00			`- attack.t1059.001`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`author: Florian Roth (rule)`
fix: fixed missing date fields in remaining files 2020-01-30 16:07:37 +01:00			`date: 2017/03/12`
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*' 2021-12-02 14:30:09 +01:00			`modified: 2021/12/02`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`logsource:`
Bugfix: PowerShell rules log source inconstency 2017-03-21 10:22:13 +01:00			`product: windows`
			`service: powershell`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`detection:`
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*' 2021-12-02 14:30:09 +01:00			`selection_encoded:`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`- ' -enc '`
			`- ' -EncodedCommand '`
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*' 2021-12-02 14:30:09 +01:00			`selection_hidden:`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`- ' -w hidden '`
			`- ' -window hidden '`
Typo fix for powershell_suspicious_invocation_generic.yml 2020-03-29 04:16:15 -06:00			`- ' -windowstyle hidden '`
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*' 2021-12-02 14:30:09 +01:00			`selection_noninteractive:`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`- ' -noni '`
			`- ' -noninteractive '`
feat: discourage the usage of 'all of them' and migrate existing rules to use the preferred method 'all of selection*' 2021-12-02 14:30:09 +01:00			`condition: all of selection*`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`falsepositives:`
Merged similar rules 2018-03-06 23:19:11 +01:00			`- Very special / sneaky PowerShell scripts`
Suspicious PowerShell Invocation 2017-03-12 17:06:53 +01:00			`level: high`