Potential Emotet PowerShell Execution
Detects process executions that exhibit characteristics commonly associated with Emotet malware, specifically focusing on obfuscated PowerShell command line arguments. The rule looks for specific base64 encoded strings and patterns often used by Emotet for defense evasion and execution.
Sigma
