SigmaHQ/rules/windows/powershell/powershell_suspicious_invocation_generic.yml

title: Suspicious PowerShell Invocations - Generic
status: experimental
description: Detects suspicious PowerShell invocation command parameters
author: Florian Roth (rule)
logsource:
    platform: windows
    product: powershell
detection:
    encoded:
        - ' -enc '
        - ' -EncodedCommand '
    hidden:
        - ' -w hidden '
        - ' -window hidden '
        - ' - windowstyle hidden '
    noninteractive:
        - ' -noni '
        - ' -noninteractive '
    condition: encoded and hidden and noninteractive
falsepositives:
    - Penetration tests
level: high