Sigma rule: Suspicious PowerShell Parameter Substring

Rule

Title

Suspicious PowerShell Parameter Substring

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)

Date

2019-01-16

Modified

2022-07-14

File

rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious PowerShell invocation with a parameter substring

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    CommandLine|contains:
        - ' -windowstyle h '
        - ' -windowstyl h'
        - ' -windowsty h'
        - ' -windowst h'
        - ' -windows h'
        - ' -windo h'
        - ' -wind h'
        - ' -win h'
        - ' -wi h'
        - ' -win h '
        - ' -win hi '
        - ' -win hid '
        - ' -win hidd '
        - ' -win hidde '
        - ' -NoPr '
        - ' -NoPro '
        - ' -NoProf '
        - ' -NoProfi '
        - ' -NoProfil '
        - ' -nonin '
        - ' -nonint '
        - ' -noninte '
        - ' -noninter '
        - ' -nonintera '
        - ' -noninterac '
        - ' -noninteract '
        - ' -noninteracti '
        - ' -noninteractiv '
        - ' -ec '
        - ' -encodedComman '
        - ' -encodedComma '
        - ' -encodedComm '
        - ' -encodedCom '
        - ' -encodedCo '
        - ' -encodedC '
        - ' -encoded '
        - ' -encode '
        - ' -encod '
        - ' -enco '
        - ' -en '
        - ' -executionpolic '
        - ' -executionpoli '
        - ' -executionpol '
        - ' -executionpo '
        - ' -executionp '
        - ' -execution bypass'
        - ' -executio bypass'
        - ' -executi bypass'
        - ' -execut bypass'
        - ' -execu bypass'
        - ' -exec bypass'
        - ' -exe bypass'
        - ' -ex bypass'
        - ' -ep bypass'
        - ' /windowstyle h '
        - ' /windowstyl h'
        - ' /windowsty h'
        - ' /windowst h'
        - ' /windows h'
        - ' /windo h'
        - ' /wind h'
        - ' /win h'
        - ' /wi h'
        - ' /win h '
        - ' /win hi '
        - ' /win hid '
        - ' /win hidd '
        - ' /win hidde '
        - ' /NoPr '
        - ' /NoPro '
        - ' /NoProf '
        - ' /NoProfi '
        - ' /NoProfil '
        - ' /nonin '
        - ' /nonint '
        - ' /noninte '
        - ' /noninter '
        - ' /nonintera '
        - ' /noninterac '
        - ' /noninteract '
        - ' /noninteracti '
        - ' /noninteractiv '
        - ' /ec '
        - ' /encodedComman '
        - ' /encodedComma '
        - ' /encodedComm '
        - ' /encodedCom '
        - ' /encodedCo '
        - ' /encodedC '
        - ' /encoded '
        - ' /encode '
        - ' /encod '
        - ' /enco '
        - ' /en '
        - ' /executionpolic '
        - ' /executionpoli '
        - ' /executionpol '
        - ' /executionpo '
        - ' /executionp '
        - ' /execution bypass'
        - ' /executio bypass'
        - ' /executi bypass'
        - ' /execut bypass'
        - ' /execu bypass'
        - ' /exec bypass'
        - ' /exe bypass'
        - ' /ex bypass'
        - ' /ep bypass'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml