MERCURY APT Encoded PowerShell Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•21

This rule detects suspicious command line patterns associated with MERCURY APT activity. Specifically, it looks for PowerShell execution with parameters '-exec bypass -w 1 -enc' combined with a base64 encoded string that decodes to 'Start-Job -ScriptBlock'. This indicates the execution of an encoded PowerShell script, often used by adversaries to obfuscate their commands and evade detection.