Elastic Defend high stable eql

Suspicious Execution via SQL PowerShell

Detects attempts to execute suspicious powershell commands using the Microsoft SQL Powershell Helper Tools.

View Source

Detection Logic

process where event.action == "start" and 
 process.name : ("SQLToolsPS.exe", "sqlps.exe") and 
 process.args : ("-e", "-enc", "-ep", "-encoded", "*;iex", "*start-process*", "*WebClient*", 
                "*DownloadFile*", "*DownloadString*", "*BitsTransfer*", "*Reflection.Assembly*")

Field Validations

Loading…

Comments (0)

Loading comments...