Unusually Long PowerShell Command Line

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects unusually long PowerShell command lines (1000 characters or more) which can be indicative of obfuscated or complex malicious scripts being executed. Attackers often use long command lines to evade detection by packing malicious code, base64 encoded commands, or other obfuscation techniques into a single line.