name: Malicious PowerShell Process - Encoded Command Unit Test
detections:
- name: Malicious PowerShell Process - Encoded Command
  file: endpoint/malicious_powershell_process___encoded_command.yml
  pass_condition: '| stats count | where count > 0'
attack_data:
- file_name: windows-sysmon.log
  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1027/windows-sysmon.log
  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
  sourcetype: xmlwineventlog