Suspicious PowerShell Invocations - Encoded, Hidden, or Non-Interactive

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•28

This rule detects suspicious PowerShell invocations by looking for specific command parameters that indicate obfuscation, hidden execution, or non-interactive sessions. Specifically, it flags the use of encoded commands (`-enc`, `-EncodedCommand`, `-ec`), hidden window styles (`-w hidden`, `-window hidden`, `-windowstyle hidden`, `-w 1`), and non-interactive flags (`-noni`, `-noninteractive`). These parameters are commonly used by adversaries to conceal their activities and bypass detection.