Suspicious PowerShell Execution with Base64 Encoded Command
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicative of base64 encoded commands. Adversaries often use base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by simple string matching. The rule specifically looks for common encoding flags such as '-e', '-en', '-enc', '-enco', or '-ec'. It filters out legitimate uses of '-Encoding' and activity from Azure Guest Configuration worker processes to reduce false positives.
Sigma
