evasive-powershell-strings

Description

This query searches for a string pattern detected in evasive PowerShell usage. Jupyter or SolarMarker will iterate on this pattern multiple times to read data and call additional processes. This query is not fully specific to Jupyter or SolarMarker, and will also return other malicious malware, but is unlikely to return false positives.

Query · kql

DeviceProcessEvents
| where FileName == "powershell.exe"
| where ProcessCommandLine has_all("-ep bypass","-command","get-content","remove-item","iex")
Raw source evasive-powershell-strings · KQL
Esc
Published by Azure/Azure-Sentinel ↗, licensed under MIT ↗. Reproduced here unmodified. 
id: d08b4ce0-3c97-4637-9577-0856f6cdd222
name: evasive-powershell-strings
description: |
  This query searches for a string pattern detected in evasive PowerShell usage. Jupyter or SolarMarker will iterate on this pattern multiple times to read data and call additional processes. This query is not fully specific to Jupyter or SolarMarker, and will also return other malicious malware, but is unlikely to return false positives.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Defense evasion
query: |
  DeviceProcessEvents
  | where FileName == "powershell.exe"
  | where ProcessCommandLine has_all("-ep bypass","-command","get-content","remove-item","iex")

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.