SigmaHQ/rules/windows/sysmon/sysmon_powershell_suspicious_parameter_combo.yml

title: Suspicious PowerShell Parameter Combination
status: experimental
description: Detects suspicious PowerShell invocation command parameters
author: Florian Roth
logsource:
    product: sysmon
detection:
    keywords:
        - 'powershell'
        - ' -nop '
        - ' -w hidden '
        - ' -exec bypass '
        - ' -enc ' 
    condition: all of keywords
falsepositives:
    - Penetration tests
    - Very special / sneaky PowerShell scripts
level: high