Sunturai
Back to results
MediumSplunk security contentDavid Dorsey +1

Malicious PowerShell Process With Obfuscation Techniques

The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process…

Description

The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and complete command-line executions. This activity is significant because obfuscated PowerShell commands are often used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a significant security risk.

Detection logic

Detection requirements

Platform
Windows

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_eventid_1

Known benign triggers

  • These characters might be legitimately on the command-line, but it is not common.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice