Rule library
// Detection
Encoded PowerShell execution
PowerShell invoked with a base64-encoded command block, a common wrapper for staged payloads that defeats plaintext command inspection.
HighInvestigating1alerts raisedSignature
Armed
What this rule does
Rendered from the stored logic, so it cannot drift from what executes.
Any event where processName contains powershell and commandLine contains -enc
{
"kind": "match",
"where": [
{
"op": "contains",
"field": "processName",
"value": "powershell"
},
{
"op": "contains",
"field": "commandLine",
"value": "-enc"
}
]
}Revise
Backtest before saving. Alerts already raised keep their original descriptions: they record what the rule found at the time.
Fields: eventType, username, sourceIp, destinationIp, hostname, processName, commandLine, parentProcess, action, status, country, city
Alerts raised (1)
What this rule has actually caught.
| Alert | Finding | Status | Risk | Raised |
|---|---|---|---|---|
| ALT-664EB4 | PowerShell ran a base64-encoded command block with a hidden window on a domain controller. | Investigating | 81 |
Rule
- Category
- Execution
- ATT&CK tactic
- Execution
- Technique
- T1059.001
- Kind
- Signature
- State
- Armed
- Created
- 7d ago
- Last changed
- 7d ago
Firing history
- Total alerts
- 1
- First fired
- 7d ago
- Last fired
- 7d ago
- Escalated to cases
- 1
- Dismissed benign
- 0