Powershell Inline Execution From A File

Title: Powershell Inline Execution From A File
Status: test
Description:Detects inline execution of PowerShell code from a file
References:
  -https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
Author: frack113
Date: 2022-12-25
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: process_creation

Detection:
  selection_exec:
    CommandLine|contains:
      -'iex '
      -'Invoke-Expression '
      -'Invoke-Command '
      -'icm '

  selection_read:
    CommandLine|contains:
      -'cat '
      -'get-content '
      -'type '

  selection_raw:
    CommandLine|contains: ' -raw'
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium