{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d')]",
      "properties": {
        "alertRuleTemplateName": "7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d",
        "customDetails": null,
        "description": "Detects PowerShell or pwsh.exe launched with encoded command flags\n(-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64\nto obfuscate malicious payloads and bypass script-based controls.\nRisk is elevated when a download cradle pattern is also detected.\nTune AllowlistedParents for known-safe management tools such as SCCM.\n",
        "displayName": "PowerShell Encoded Command Execution (Living off the Land)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "Process",
            "fieldMappings": [
              {
                "columnName": "ProcessCommandLine",
                "identifier": "CommandLine"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker%20Tools%20Threat%20Protection%20Essentials/Analytic%20Rules/PowerShell-Abuse.yaml",
        "query": "let Lookback = 1h;\nlet EncodedFlagRegex = @'(?i)(^|\\s)-(encodedcommand|enc|ec|enco)\\b';\nlet AllowlistedParents = dynamic([\n  \"SqlServer.exe\", \"ManagementStudio.exe\", \"devenv.exe\",\n  \"ccmexec.exe\", \"SMSAgent.exe\"\n]);\nlet DownloadCradlePatterns = dynamic([\n  \"Net.WebClient\", \"WebRequest\", \"DownloadString\", \"DownloadFile\",\n  \"IEX\", \"Invoke-Expression\", \"Invoke-RestMethod\", \"Start-BitsTransfer\"\n]);\nlet MDE_Results =\n  DeviceProcessEvents\n  | where Timestamp >= ago(Lookback)\n  | where FileName in~ (\"powershell.exe\", \"pwsh.exe\")\n  | where ProcessCommandLine matches regex EncodedFlagRegex\n  | where not(InitiatingProcessFileName has_any (AllowlistedParents))\n  | extend\n      HasDownloadCradle = ProcessCommandLine has_any (DownloadCradlePatterns),\n      AccountName       = InitiatingProcessAccountName,\n      AccountDomain     = InitiatingProcessAccountDomain,\n      HostName          = DeviceName,\n      EventTime         = Timestamp\n  | project EventTime, HostName, AccountName, AccountDomain,\n      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;\nlet SecEvent_Results =\n  SecurityEvent\n  | where TimeGenerated >= ago(Lookback)\n  | where EventID == 4688\n  | where NewProcessName endswith \"\\\\powershell.exe\"\n      or NewProcessName endswith \"\\\\pwsh.exe\"\n  | where CommandLine matches regex EncodedFlagRegex\n  | where not(ParentProcessName has_any (AllowlistedParents))\n  | extend\n      HasDownloadCradle     = CommandLine has_any (DownloadCradlePatterns),\n      AccountName           = SubjectUserName,\n      AccountDomain         = SubjectDomainName,\n      HostName              = Computer,\n      EventTime             = TimeGenerated,\n      ProcessCommandLine    = CommandLine,\n      InitiatingProcessFileName = ParentProcessName\n  | project EventTime, HostName, AccountName, AccountDomain,\n      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;\nunion MDE_Results, SecEvent_Results\n| extend RiskScore = iif(HasDownloadCradle, 2, 1)\n| sort by RiskScore desc, EventTime desc\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [
          "T1059.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution"
        ],
        "techniques": [
          "T1027",
          "T1059"
        ],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}