LoFP LoFP / legitimate admin or third party scripts. baseline according to your environment

Techniques

Sample rules

Suspicious Powershell In Registry Run Keys

Description

Detects potential PowerShell commands or code within registry run keys

Detection logic

condition: selection
selection:
  Details|contains:
  - powershell
  - 'pwsh '
  - FromBase64String
  - .DownloadFile(
  - .DownloadString(
  - ' -w hidden '
  - ' -w 1 '
  - -windowstyle hidden
  - -window hidden
  - ' -nop '
  - ' -encodedcommand '
  - -ExecutionPolicy Bypass
  - Invoke-Expression
  - IEX (
  - Invoke-Command
  - ICM -
  - Invoke-WebRequest
  - 'IWR '
  - ' -noni '
  - ' -noninteractive '
  TargetObject|contains: \Software\Microsoft\Windows\CurrentVersion\Run