PowerShell Encoded Command Execution Living off the Land

Back


Id	7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d
Rulename	PowerShell Encoded Command Execution (Living off the Land)
Description	Detects PowerShell or pwsh.exe launched with encoded command flags (-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64 to obfuscate malicious payloads and bypass script-based controls. Risk is elevated when a download cradle pattern is also detected. Tune AllowlistedParents for known-safe management tools such as SCCM.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1059.001 T1027
Required data connectors	MicrosoftThreatProtection SecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker%20Tools%20Threat%20Protection%20Essentials/Analytic%20Rules/PowerShell-Abuse.yaml
Version	1.0.4
Arm template	7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d.json

KQL

let Lookback = 1h;
let EncodedFlagRegex = @'(?i)(^|\s)-(encodedcommand|enc|ec|enco)\b';
let AllowlistedParents = dynamic([
  "SqlServer.exe", "ManagementStudio.exe", "devenv.exe",
  "ccmexec.exe", "SMSAgent.exe"
]);
let DownloadCradlePatterns = dynamic([
  "Net.WebClient", "WebRequest", "DownloadString", "DownloadFile",
  "IEX", "Invoke-Expression", "Invoke-RestMethod", "Start-BitsTransfer"
]);
let MDE_Results =
  DeviceProcessEvents
  | where Timestamp >= ago(Lookback)
  | where FileName in~ ("powershell.exe", "pwsh.exe")
  | where ProcessCommandLine matches regex EncodedFlagRegex
  | where not(InitiatingProcessFileName has_any (AllowlistedParents))
  | extend
      HasDownloadCradle = ProcessCommandLine has_any (DownloadCradlePatterns),
      AccountName       = InitiatingProcessAccountName,
      AccountDomain     = InitiatingProcessAccountDomain,
      HostName          = DeviceName,
      EventTime         = Timestamp
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;
let SecEvent_Results =
  SecurityEvent
  | where TimeGenerated >= ago(Lookback)
  | where EventID == 4688
  | where NewProcessName endswith "\\powershell.exe"
      or NewProcessName endswith "\\pwsh.exe"
  | where CommandLine matches regex EncodedFlagRegex
  | where not(ParentProcessName has_any (AllowlistedParents))
  | extend
      HasDownloadCradle     = CommandLine has_any (DownloadCradlePatterns),
      AccountName           = SubjectUserName,
      AccountDomain         = SubjectDomainName,
      HostName              = Computer,
      EventTime             = TimeGenerated,
      ProcessCommandLine    = CommandLine,
      InitiatingProcessFileName = ParentProcessName
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;
union MDE_Results, SecEvent_Results
| extend RiskScore = iif(HasDownloadCradle, 2, 1)
| sort by RiskScore desc, EventTime desc

YAML

tactics:
- Execution
- DefenseEvasion
requiredDataConnectors:
- dataTypes:
  - DeviceProcessEvents
  connectorId: MicrosoftThreatProtection
- dataTypes:
  - SecurityEvent
  connectorId: SecurityEvents
queryPeriod: 1h
kind: Scheduled
severity: Medium
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker%20Tools%20Threat%20Protection%20Essentials/Analytic%20Rules/PowerShell-Abuse.yaml
queryFrequency: 1h
triggerThreshold: 0
description: |
  Detects PowerShell or pwsh.exe launched with encoded command flags
  (-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64
  to obfuscate malicious payloads and bypass script-based controls.
  Risk is elevated when a download cradle pattern is also detected.
  Tune AllowlistedParents for known-safe management tools such as SCCM.
id: 7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d
triggerOperator: gt
status: Available
relevantTechniques:
- T1059.001
- T1027
version: 1.0.4
name: PowerShell Encoded Command Execution (Living off the Land)
entityMappings:
- entityType: Host
  fieldMappings:
  - columnName: HostName
    identifier: FullName
- entityType: Account
  fieldMappings:
  - columnName: AccountName
    identifier: Name
  - columnName: AccountDomain
    identifier: NTDomain
- entityType: Process
  fieldMappings:
  - columnName: ProcessCommandLine
    identifier: CommandLine
query: |
  let Lookback = 1h;
  let EncodedFlagRegex = @'(?i)(^|\s)-(encodedcommand|enc|ec|enco)\b';
  let AllowlistedParents = dynamic([
    "SqlServer.exe", "ManagementStudio.exe", "devenv.exe",
    "ccmexec.exe", "SMSAgent.exe"
  ]);
  let DownloadCradlePatterns = dynamic([
    "Net.WebClient", "WebRequest", "DownloadString", "DownloadFile",
    "IEX", "Invoke-Expression", "Invoke-RestMethod", "Start-BitsTransfer"
  ]);
  let MDE_Results =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine matches regex EncodedFlagRegex
    | where not(InitiatingProcessFileName has_any (AllowlistedParents))
    | extend
        HasDownloadCradle = ProcessCommandLine has_any (DownloadCradlePatterns),
        AccountName       = InitiatingProcessAccountName,
        AccountDomain     = InitiatingProcessAccountDomain,
        HostName          = DeviceName,
        EventTime         = Timestamp
    | project EventTime, HostName, AccountName, AccountDomain,
        ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;
  let SecEvent_Results =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where NewProcessName endswith "\\powershell.exe"
        or NewProcessName endswith "\\pwsh.exe"
    | where CommandLine matches regex EncodedFlagRegex
    | where not(ParentProcessName has_any (AllowlistedParents))
    | extend
        HasDownloadCradle     = CommandLine has_any (DownloadCradlePatterns),
        AccountName           = SubjectUserName,
        AccountDomain         = SubjectDomainName,
        HostName              = Computer,
        EventTime             = TimeGenerated,
        ProcessCommandLine    = CommandLine,
        InitiatingProcessFileName = ParentProcessName
    | project EventTime, HostName, AccountName, AccountDomain,
        ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;
  union MDE_Results, SecEvent_Results
  | extend RiskScore = iif(HasDownloadCradle, 2, 1)
  | sort by RiskScore desc, EventTime desc

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d')]",
      "properties": {
        "alertRuleTemplateName": "7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d",
        "customDetails": null,
        "description": "Detects PowerShell or pwsh.exe launched with encoded command flags\n(-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64\nto obfuscate malicious payloads and bypass script-based controls.\nRisk is elevated when a download cradle pattern is also detected.\nTune AllowlistedParents for known-safe management tools such as SCCM.\n",
        "displayName": "PowerShell Encoded Command Execution (Living off the Land)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "Process",
            "fieldMappings": [
              {
                "columnName": "ProcessCommandLine",
                "identifier": "CommandLine"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker%20Tools%20Threat%20Protection%20Essentials/Analytic%20Rules/PowerShell-Abuse.yaml",
        "query": "let Lookback = 1h;\nlet EncodedFlagRegex = @'(?i)(^|\\s)-(encodedcommand|enc|ec|enco)\\b';\nlet AllowlistedParents = dynamic([\n  \"SqlServer.exe\", \"ManagementStudio.exe\", \"devenv.exe\",\n  \"ccmexec.exe\", \"SMSAgent.exe\"\n]);\nlet DownloadCradlePatterns = dynamic([\n  \"Net.WebClient\", \"WebRequest\", \"DownloadString\", \"DownloadFile\",\n  \"IEX\", \"Invoke-Expression\", \"Invoke-RestMethod\", \"Start-BitsTransfer\"\n]);\nlet MDE_Results =\n  DeviceProcessEvents\n  | where Timestamp >= ago(Lookback)\n  | where FileName in~ (\"powershell.exe\", \"pwsh.exe\")\n  | where ProcessCommandLine matches regex EncodedFlagRegex\n  | where not(InitiatingProcessFileName has_any (AllowlistedParents))\n  | extend\n      HasDownloadCradle = ProcessCommandLine has_any (DownloadCradlePatterns),\n      AccountName       = InitiatingProcessAccountName,\n      AccountDomain     = InitiatingProcessAccountDomain,\n      HostName          = DeviceName,\n      EventTime         = Timestamp\n  | project EventTime, HostName, AccountName, AccountDomain,\n      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;\nlet SecEvent_Results =\n  SecurityEvent\n  | where TimeGenerated >= ago(Lookback)\n  | where EventID == 4688\n  | where NewProcessName endswith \"\\\\powershell.exe\"\n      or NewProcessName endswith \"\\\\pwsh.exe\"\n  | where CommandLine matches regex EncodedFlagRegex\n  | where not(ParentProcessName has_any (AllowlistedParents))\n  | extend\n      HasDownloadCradle     = CommandLine has_any (DownloadCradlePatterns),\n      AccountName           = SubjectUserName,\n      AccountDomain         = SubjectDomainName,\n      HostName              = Computer,\n      EventTime             = TimeGenerated,\n      ProcessCommandLine    = CommandLine,\n      InitiatingProcessFileName = ParentProcessName\n  | project EventTime, HostName, AccountName, AccountDomain,\n      ProcessCommandLine, InitiatingProcessFileName, HasDownloadCradle;\nunion MDE_Results, SecEvent_Results\n| extend RiskScore = iif(HasDownloadCradle, 2, 1)\n| sort by RiskScore desc, EventTime desc\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [
          "T1059.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution"
        ],
        "techniques": [
          "T1027",
          "T1059"
        ],
        "templateVersion": "1.0.4",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}