← Library
kqlElastic-2.0from elastic/detection-rules

Suspicious Portable Executable Encoded in Powershell Script

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1059T1059.001T1027T1027.013T1055
Rule sourcerules/windows/execution_posh_portable_executable.toml
event.category:process and host.os.type:windows and
  powershell.file.script_block_text : (
    TVqQAAMAAAAEAAAA
  ) and not user.id : "S-1-5-18"