Suspicious PowerShell curl flags

Description

Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing uncommon PowerShell flags to communicate to command-and-control infrastructure.

Query · kql

DeviceProcessEvents
| where FileName =~ "powershell.exe"
| where ProcessCommandLine has_all("-met", "POST", "-Body")
Raw source Suspicious PowerShell curl flags · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: 9cde2f21-35c9-452b-b149-ebbed3d0c7ae
name: Suspicious PowerShell curl flags
description: |
  Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing uncommon PowerShell flags to communicate to command-and-control infrastructure.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Vulnerability
query: |
  DeviceProcessEvents
  | where FileName =~ "powershell.exe"
  | where ProcessCommandLine has_all("-met", "POST", "-Body")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.