Dev-0270 Malicious Powershell usage

DEV-0270 heavily uses powershell to achieve their objective at various stages of their attack. To locate powershell related activity tied to the actor, Microsoft Sentinel customers can run the following query.

Detection logic

Detection requirements

Platform: Containers ESXi IaaS Identity Provider Linux macOS Network Devices Office Suite SaaS Windows
The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.
Log source product: microsoftthreatprotection securityevents windowssecurityevents
Log source service: deviceprocessevents securityevent

Detection rules

Dev-0270 Malicious Powershell usage

Detection logic

Detection requirements

MITRE ATT&CK mappings

From the source

Licence

Authorship

Detection rules