Suspicious PowerShell Activity via Registry or File System Access
This rule detects suspicious PowerShell activity by monitoring Windows events for process creation (EventCode 13) or registry modifications (EventCode 4657) that involve PowerShell or pwsh. It specifically looks for the use of obfuscation or evasion techniques within the command details, such as 'iex', 'Invoke-Expression', 'DownloadString', 'DownloadFile', '.Net.WebClient', 'FromBase64String', hidden window styles ('-w hidden', '-windowstyle hidden'), execution policy bypass ('-ep bypass', '-executionpolicy bypass'), or encoded commands ('-enc', '-encodedcommand'). This combination of event codes and keywords suggests an attempt to execute malicious or obfuscated PowerShell scripts.
Splunk (SPL)
