Elastic Defend high stable eql

Encoded Powershell Execution via MsiExec

Detects attempts to execute encoded powershell commands via Windows Installers.

View Source

Detection Logic

process where event.action == "start" and
 (process.name : "powershell.exe" or process.pe.original_file_name == "PowerShell.EXE") and
 process.args : ("-e", "-enc", "-ec", "-encod", "-encode", "iex (gc *") and
 (
  descendant of [process where event.action == "start" and process.name : "msiexec.exe"] or
  process.parent.name : "msiexec.exe"
  )

Field Validations

Loading…

Comments (0)

Loading comments...