{"id":"36210e0d-5b19-485d-a087-c096088885f0","title":"Suspicious PowerShell Parameter Substring","description":"Detects suspicious PowerShell invocation with a parameter substring","author":"Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)","status":"test","level":"high","date":"2019-01-16","modified":"2022-07-14","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml","source_sha256":"da2ab44f637116ed326fc3f64f0ac76afa94509ab936425439e078f765893e07","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious PowerShell Parameter Substring\nid: 36210e0d-5b19-485d-a087-c096088885f0\nstatus: test\ndescription: Detects suspicious PowerShell invocation with a parameter substring\nreferences:\n    - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier\nauthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)\ndate: 2019-01-16\nmodified: 2022-07-14\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        Image|endswith:\n            - '\\powershell.exe'\n            - '\\pwsh.exe'\n        CommandLine|contains:\n            - ' -windowstyle h '\n            - ' -windowstyl h'\n            - ' -windowsty h'\n            - ' -windowst h'\n            - ' -windows h'\n            - ' -windo h'\n            - ' -wind h'\n            - ' -win h'\n            - ' -wi h'\n            - ' -win h '\n            - ' -win hi '\n            - ' -win hid '\n            - ' -win hidd '\n            - ' -win hidde '\n            - ' -NoPr '\n            - ' -NoPro '\n            - ' -NoProf '\n            - ' -NoProfi '\n            - ' -NoProfil '\n            - ' -nonin '\n            - ' -nonint '\n            - ' -noninte '\n            - ' -noninter '\n            - ' -nonintera '\n            - ' -noninterac '\n            - ' -noninteract '\n            - ' -noninteracti '\n            - ' -noninteractiv '\n            - ' -ec '\n            - ' -encodedComman '\n            - ' -encodedComma '\n            - ' -encodedComm '\n            - ' -encodedCom '\n            - ' -encodedCo '\n            - ' -encodedC '\n            - ' -encoded '\n            - ' -encode '\n            - ' -encod '\n            - ' -enco '\n            - ' -en '\n            - ' -executionpolic '\n            - ' -executionpoli '\n            - ' -executionpol '\n            - ' -executionpo '\n            - ' -executionp '\n            - ' -execution bypass'\n            - ' -executio bypass'\n            - ' -executi bypass'\n            - ' -execut bypass'\n            - ' -execu bypass'\n            - ' -exec bypass'\n            - ' -exe bypass'\n            - ' -ex bypass'\n            - ' -ep bypass'\n            - ' /windowstyle h '\n            - ' /windowstyl h'\n            - ' /windowsty h'\n            - ' /windowst h'\n            - ' /windows h'\n            - ' /windo h'\n            - ' /wind h'\n            - ' /win h'\n            - ' /wi h'\n            - ' /win h '\n            - ' /win hi '\n            - ' /win hid '\n            - ' /win hidd '\n            - ' /win hidde '\n            - ' /NoPr '\n            - ' /NoPro '\n            - ' /NoProf '\n            - ' /NoProfi '\n            - ' /NoProfil '\n            - ' /nonin '\n            - ' /nonint '\n            - ' /noninte '\n            - ' /noninter '\n            - ' /nonintera '\n            - ' /noninterac '\n            - ' /noninteract '\n            - ' /noninteracti '\n            - ' /noninteractiv '\n            - ' /ec '\n            - ' /encodedComman '\n            - ' /encodedComma '\n            - ' /encodedComm '\n            - ' /encodedCom '\n            - ' /encodedCo '\n            - ' /encodedC '\n            - ' /encoded '\n            - ' /encode '\n            - ' /encod '\n            - ' /enco '\n            - ' /en '\n            - ' /executionpolic '\n            - ' /executionpoli '\n            - ' /executionpol '\n            - ' /executionpo '\n            - ' /executionp '\n            - ' /execution bypass'\n            - ' /executio bypass'\n            - ' /executi bypass'\n            - ' /execut bypass'\n            - ' /execu bypass'\n            - ' /exec bypass'\n            - ' /exe bypass'\n            - ' /ex bypass'\n            - ' /ep bypass'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/36210e0d-5b19-485d-a087-c096088885f0.json","kind":"sigma"}