legitimate large or encoded powershell scripts (automation frameworks, installers, or admin tooling) can exhibit high entropy or uneven character distributions.

Techniques

Sample rules

Potential PowerShell Obfuscated Script via High Entropy

source: elastic
technicques:
- T1027
- T1059
- T1140

Description

Identifies PowerShell script blocks with high entropy and non-uniform character distributions. Attackers may obfuscate PowerShell scripts using encoding, encryption, or compression techniques to evade signature-based detections and hinder manual analysis by security analysts.

Detection logic

event.category:process and host.os.type:windows and powershell.file.script_block_length > 1000 and
  powershell.file.script_block_entropy_bits >= 5.5 and powershell.file.script_block_surprisal_stdev > 0.7 and
  not file.directory: (
        "C:\Program Files (x86)\Microsoft Intune Management Extension\Content\DetectionScripts" or
        "C:\Program Files\Microsoft Azure AD Connect Health Agent\Products\AdFederationService\AdfsDiagnostics\AdfsToolbox\diagnosticsModule\Private"
  ) and
  not (file.directory: "C:\ProgramData\Qualys\QualysTemp" and user.id: "S-1-5-18") and
  not (file.directory: C\:\\Program*Files\\WindowsPowerShell\\Modules\\dbatools* and file.name: "allcommands.ps1")