name: Malicious PowerShell Process - Encoded Command
id: c4db14d9-7909-48b4-a054-aa14d89dbb19
version: 3
date: '2018-12-03'
description: This search looks for PowerShell processes that have encoded the script
  within the command-line. Malware has been seen using this parameter, as it obfuscates
  the code and makes it relatively easy to pass a script on the command-line.
how_to_implement: You must be ingesting data that records process activity from your
  hosts to populate the Endpoint data model in the Processes node. You must also be
  ingesting logs with both the process name and command line from your endpoints.
  The command-line arguments are mapped to the "process" field in the Endpoint data
  model.
type: ESCU
references: []
author: David Dorsey, Splunk
search: '| tstats `security_content_summariesonly` count values(Processes.process)
  as process values(Processes.parent_process) as parent_process min(_time) as firstTime
  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe
  by Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
  | search process=*-EncodedCommand* OR  process=*-enc* | `malicious_powershell_process___encoded_command_filter`'
known_false_positives: System administrators may use this option, but it's not common.
tags:
  analytics_story:
  - Malicious PowerShell
  mitre_attack_id:
  - T1086
  - T1064
  kill_chain_phases:
  - Command and Control
  - Actions on Objectives
  cis20:
  - CIS 3
  - CIS 7
  - CIS 8
  nist:
  - PR.PT
  - DE.CM
  - PR.IP
  security_domain: endpoint
  asset_type: Endpoint