elastalert_sysmon_powershell_suspicious_parameter_variation_needsfix.yml

alert:
- slack
slack_webhook_url: https://hooks.slack.com/services/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
description: Detects suspicious PowerShell invocation with a parameter substring
filter:
- query:
    query_string:
      query: (process_path:"*\\powershell.exe" AND (" \-windowstyle h " OR " \-windowstyl
        h" OR " \-windowsty h" OR " \-windowst h" OR " \-windows h" OR " \-windo h"
        OR " \-wind h" OR " \-win h" OR " \-wi h" OR " \-win h " OR " \-win hi " OR
        " \-win hid " OR " \-win hidd " OR " \-win hidde " OR " \-NoPr " OR " \-NoPro
        " OR " \-NoProf " OR " \-NoProfi " OR " \-NoProfil " OR " \-nonin " OR " \-nonint
        " OR " \-noninte " OR " \-noninter " OR " \-nonintera " OR " \-noninterac
        " OR " \-noninteract " OR " \-noninteracti " OR " \-noninteractiv " OR " \-ec
        " OR " \-encodedComman " OR " \-encodedComma " OR " \-encodedComm " OR " \-encodedCom
        " OR " \-encodedCo " OR " \-encodedC " OR " \-encoded " OR " \-encode " OR
        " \-encod " OR " \-enco " OR " \-en "))
index: logs-endpoint-winevent-sysmon-*
name: Suspicious-PowerShell-Parameter-Substring_0
priority: 2
realert:
  minutes: 0
type: any