elastalert_sysmon_powershell_suspicious_parameter_variation_needsfix2.yml

alert:
- slack
slack_webhook_url: https://hooks.slack.com/services/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
description: Detects suspicious PowerShell invocation with a parameter substring
filter:
- query:
    query_string:
      query: (process_path:("*\\Powershell.exe") AND event_id:"1" AND process_command_line:("
        \-windowstyle h " " \-windowstyl h" " \-windowsty h" " \-windowst h" " \-windows
        h" " \-windo h" " \-wind h" " \-win h" " \-wi h" " \-win h " " \-win hi "
        " \-win hid " " \-win hidd " " \-win hidde " " \-NoPr " " \-NoPro " " \-NoProf
        " " \-NoProfi " " \-NoProfil " " \-nonin " " \-nonint " " \-noninte " " \-noninter
        " " \-nonintera " " \-noninterac " " \-noninteract " " \-noninteracti " "
        \-noninteractiv " " \-ec " " \-encodedComman " " \-encodedComma " " \-encodedComm
        " " \-encodedCom " " \-encodedCo " " \-encodedC " " \-encoded " " \-encode
        " " \-encod " " \-enco " " \-en "))
index: logs-endpoint-winevent-sysmon-*
name: Suspicious-PowerShell-Parameter-Substring_0
priority: 2
realert:
  minutes: 0
type: any