Empire PowerShell Launch Parameters
This rule detects suspicious command-line parameters commonly used by the Empire post-exploitation framework when launching PowerShell. Specifically, it looks for combinations of parameters such as '-NoP', '-sta', '-NonI', '-W Hidden', '-Enc', '-noP', '-w 1', '-enc', '-enc SQB', '-nop', '-exec bypass', and '-EncodedCommand'. These parameters are often used to execute encoded PowerShell scripts in a hidden or non-interactive manner, which is a common tactic for malicious PowerShell execution.
Sigma
