
title: Suspicious PowerShell Parameter Substring
author: Florian Roth (rule), Daniel Bohannon (idea), Roberto Rodriguez (Fix)
date: 2019/01/16
description: Detects suspicious PowerShell invocation with a parameter substring
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image:
    - '*\Powershell.exe'
  SELECTION_3:
    CommandLine:
    - '* -windowstyle h *'
    - '* -windowstyl h*'
    - '* -windowsty h*'
    - '* -windowst h*'
    - '* -windows h*'
    - '* -windo h*'
    - '* -wind h*'
    - '* -win h*'
    - '* -wi h*'
    - '* -win h *'
    - '* -win hi *'
    - '* -win hid *'
    - '* -win hidd *'
    - '* -win hidde *'
    - '* -NoPr *'
    - '* -NoPro *'
    - '* -NoProf *'
    - '* -NoProfi *'
    - '* -NoProfil *'
    - '* -nonin *'
    - '* -nonint *'
    - '* -noninte *'
    - '* -noninter *'
    - '* -nonintera *'
    - '* -noninterac *'
    - '* -noninteract *'
    - '* -noninteracti *'
    - '* -noninteractiv *'
    - '* -ec *'
    - '* -encodedComman *'
    - '* -encodedComma *'
    - '* -encodedComm *'
    - '* -encodedCom *'
    - '* -encodedCo *'
    - '* -encodedC *'
    - '* -encoded *'
    - '* -encode *'
    - '* -encod *'
    - '* -enco *'
    - '* -en *'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Penetration tests
id: 36210e0d-5b19-485d-a087-c096088885f0
level: high
logsource:
  category: process_creation
  product: windows
modified: 2020/07/14
references:
- http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
status: experimental
tags:
- attack.execution
- attack.t1086
- attack.t1059.001
ruletype: SIGMA
