Sunturai
Back to results
UnknownMicrosoft Sentinel analytics

PowerShell Encoded Command Execution

Looks for variations of the PowerShell -EncodedCommand parameter, commonly used to obfuscate commands. Not all occurrences are malicious, so base64 decode the command for analysis. Tune noisy results by grouping on…

Description

Looks for variations of the PowerShell -EncodedCommand parameter, commonly used to obfuscate commands. Not all occurrences are malicious, so base64 decode the command for analysis. Tune noisy results by grouping on parent process or rare commands.

Detection logic

Detection requirements

Platform
ESXiLinuxmacOSNetwork DevicesWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source product
microsoftthreatprotectionsecurityeventswindowssecurityevents
Log source service
deviceeventssecurityevent

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice