Suspicious PowerShell Parameter Substring Usage
Detects suspicious PowerShell invocations using partial parameter names for common obfuscation techniques. This rule specifically looks for truncated forms of parameters like '-windowstyle hidden', '-NoProfile', '-NonInteractive', '-EncodedCommand', and '-ExecutionPolicy Bypass', which are frequently used by adversaries to hide their activity or bypass security measures.
Sigma
