atexec-pro - Suspicious PowerShell script

{
  "selection_base": {
    "EventID": 4104,
    "ScriptBlockText
| contains
| all": [
      "[System.Convert]::ToBase64String(",
      "[System.Convert]::FromBase64String(",
      "New-Object System.Security.Cryptography.AesManaged",
      "[System.Security.Cryptography.CipherMode]::CBC",
      ".CreateEncryptor()",
      ".CreateDecryptor()",
      "New-Object -ComObject Schedule.Service",
      ".GetTask(",
      ".RegistrationInfo.Description",
      ".RegisterTaskDefinition("
    ]
  },
  "selection_script_cmd": {
    "ScriptBlockText
| contains": "iex"
  },
  "selection_script_upload": {
    "ScriptBlockText
| contains": "Set-Content -Path "
  },
  "selection_script_download": {
    "ScriptBlockText
| contains": "Get-Content -Path "
  },
  "selection_script_net": {
    "ScriptBlockText
| contains
| all": [
      "[System.Reflection.Assembly]::Load(",
      "New-Object System.IO.StreamWriter",
      ".Invoke(",
      "New-Object System.IO.StreamReader("
    ]
  },
  "condition": "selection_base and 1 of selection_script*"
}

False Positives

• ⚠ Legitimate scripts using these cmdlets