heroui logo

Potential PowerShell Command Line Obfuscation

Sigma Rules

View Source
Summary
This detection rule identifies obfuscated PowerShell command lines that utilize special characters, which are often a sign of malicious intent. Specifically, it looks for PowerShell executions of both 'powershell.exe' and 'pwsh.exe' with specific signatures in their command lines. Certain patterns such as sequences of plus signs (+), braces ({), carets (^), and grave accents (`) are indicative of potential command obfuscation. Additionally, the rule includes optional filters to minimize false positives from legitimate applications like Amazon SSM or Windows Defender ATP, ensuring a more precise identification of potentially malicious activities. The rule is set to a high priority level due to the severity of threats associated with PowerShell abuse in cybersecurity contexts.
Categories
  • Endpoint
  • Windows
Data Sources
  • Process
Created: 2020-10-15