Anvilogic medium experimental other
Suspicious PowerShell Parameter Substring [snowflake-crowdstrikefdr_process]
Threat actors may use obfuscated and truncated PowerShell execution arguments to evade detection, leveraging PowerShell's parameter binding functionality that allows partial matching of command-line arguments. This use case detects process executions containing substrings for commonly abused PowerShell parameters.
Detection Logic
select * from crowdstrikefdr_process where event_time > dateadd(hour, -2, sysdate()) and event_platform ilike '%Win%' and (process_path ilike '%cmd.exe' or process_path ilike '%powershell.exe' or process_path ilike '%pwsh.exe') and regexp_like(process, '.*\\\s(-
| \\\/)(win?d?o?w?s?t?y?l?\\\s+hi?d?d?e?
| windowstyle\\\s+h\\\s
| NoPro?f?i?l?\\\s
| nonint?e?r?a?c?t?i?v?\\\s
| enc?o?d?e?d?C?o?m?m?a?n?\\\s
| ((exe?c?u?t?i?o?n?p?o?l?i?c?)
| ep)\\\s+(bypass)?
| ec\\\s).*', 'i')Field Validations
Loading…
Comments (0)
Loading comments...