LoFP LoFP / very special / sneaky powershell scripts

Techniques

Sample rules

Suspicious PowerShell Invocations - Generic - PowerShell Module

Description

Detects suspicious PowerShell invocation command parameters

Detection logic

condition: all of selection*
selection_encoded:
  ContextInfo|contains:
  - ' -enc '
  - ' -EncodedCommand '
  - ' -ec '
selection_hidden:
  ContextInfo|contains:
  - ' -w hidden '
  - ' -window hidden '
  - ' -windowstyle hidden '
  - ' -w 1 '
selection_noninteractive:
  ContextInfo|contains:
  - ' -noni '
  - ' -noninteractive '

Suspicious PowerShell Invocations - Generic

Description

Detects suspicious PowerShell invocation command parameters

Detection logic

condition: all of selection*
selection_encoded:
  ScriptBlockText|contains:
  - ' -enc '
  - ' -EncodedCommand '
  - ' -ec '
selection_hidden:
  ScriptBlockText|contains:
  - ' -w hidden '
  - ' -window hidden '
  - ' -windowstyle hidden '
  - ' -w 1 '
selection_noninteractive:
  ScriptBlockText|contains:
  - ' -noni '
  - ' -noninteractive '