Elastic Defend high stable eql

Potential PowerShell Empire Execution

Identifies the execution of PowerShell with suspicious argument values. This behavior is often observed during malware installation leveraging PowerShell.

View Source

Detection Logic

process where event.action == "start" and process.name : "powershell.exe" and
 process.command_line : ("* -noP -sta -w 1 -enc  SQBmACgAJABQAFMAV*",
                         "* hidden -e SQBmACgAJABQAFMAV*",
                         "* -noP -sta -w 1 -enc  IAAgA*",
                         "*LwBkAG8AdwBuAGwAbwBhAGQALwBwAG8AdwBlAHIAcwBoAGUAbABsAC8AJw*",
                         "*AvAGQAbwB3AG4AbABvAGEAZAAvAGMAcwBoAGEAcgBwAC8AIgApADsA*",
                         "*AAKAAkAEkAVgArACQASwApACkAfABJAEUAWAA=*",
                         "*IAAgACYAKAAiAHsAMgB9AHsAMAB9AHsAMQB9ACIA*")

Field Validations

Loading…

Comments (0)

Loading comments...