Suspicious Encoded PowerShell Command Line

SigmaHQ Detections@sigmaHQ

•updated Apr 6, 2023•0•0•0

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)