
title: Suspicious PowerShell Invocations - Generic
author: Florian Roth (rule)
date: 2017/03/12
description: Detects suspicious PowerShell invocation command parameters
detection:
  SELECTION_1:
    ContextInfo:
    - '* -enc *'
    - '* -EncodedCommand *'
  SELECTION_2:
    ContextInfo:
    - '* -w hidden *'
    - '* -window hidden *'
    - '* -windowstyle hidden *'
  SELECTION_3:
    ContextInfo:
    - '* -noni *'
    - '* -noninteractive *'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Penetration tests
- Very special / sneaky PowerShell scripts
id: bbb80e91-5746-4fbe-8898-122e2cafdbf4
level: high
logsource:
  category: ps_module
  product: windows
modified: 2021/10/18
related:
- id: 3d304fda-78aa-43ed-975c-d740798a49c1
  type: derived
status: experimental
tags:
- attack.execution
- attack.t1059.001
- attack.t1086
ruletype: SIGMA
