Suspicious PowerShell Invocations - Process Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•41

Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious PowerShell execution. This includes attempts to execute base64 encoded commands, use of `IEX` (Invoke-Expression) with hidden windows and `New-Object`, execution of encoded commands, and use of `WebClient` to download and execute content.