MITRE CAR unknown stable eql

Powershell Execution

[PowerShell](https://attack.mitre.org/techniques/T1059/001/) is a scripting environment included with Windows that is used by both attackers and administrators. Execution of PowerShell scripts in most Windows versions is opaque and not typically secured by antivirus which makes using PowerShell an easy way to circumvent security measures. This analytic detects execution of PowerShell scripts. Powershell can be used to hide monitored command line execution such as: - `net use` - `sc start`

View Source

Detection Logic

process where subtype.create and
  (process_name == "powershell.exe" and parent_process_name != "explorer.exe")

Field Validations

Loading…

Comments (0)

Loading comments...