powershell-version-2.0-execution

Description

Find the execution of PowerShell Version 2.0, eather to discover legacy scripts using version 2 or to find attackers trying to hide from script logging and AMSI.

Query · kql

DeviceProcessEvents
| where FileName in~ ("powershell.exe", "powershell_ise.exe")
| where ProcessCommandLine has "-v 2"
   or ProcessCommandLine has "-v 2.0"
   or ProcessCommandLine has "-version 2"
   or ProcessCommandLine has "-version 2.0"
Raw source powershell-version-2.0-execution · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 76e64c0d-b640-4724-8096-4c4cda0ec6e0
name: powershell-version-2.0-execution
description: |
  Find the execution of PowerShell Version 2.0, eather to discover legacy scripts using version 2 or to find attackers trying to hide from script logging and AMSI.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
query: |
  DeviceProcessEvents
  | where FileName in~ ("powershell.exe", "powershell_ise.exe")
  | where ProcessCommandLine has "-v 2"
     or ProcessCommandLine has "-v 2.0"
     or ProcessCommandLine has "-version 2"
     or ProcessCommandLine has "-version 2.0"

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.