legitimate administrative scripts may use this functionality. use \"parentimage\" in combination with the script names and allowed users and applications to filter legitimate executions

source: <a href=https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml>sigma
technicques: t1132 t1132.001

Techniques

Detects attempts of decoding encoded Gzip archives via PowerShell.

condition: selection
selection:
  CommandLine|contains|all:
  - GZipStream
  - ::Decompress