PowerShell Encoded Command Execution Living off the Land

Back


Id	7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d
Rulename	PowerShell Encoded Command Execution (Living off the Land)
Description	Detects PowerShell or pwsh.exe launched with encoded command flags (-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64 to obfuscate malicious payloads and bypass script-based controls. Risk is elevated when a download cradle pattern is also detected. Tune AllowlistedParents for known-safe management tools such as SCCM.
Severity	Medium
Tactics	Execution DefenseEvasion
Techniques	T1059.001 T1027
Required data connectors	MicrosoftThreatProtection SecurityEvents
Kind	Scheduled
Query frequency	1h
Query period	1h
Trigger threshold	0
Trigger operator	gt
Source Uri	https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker%20Tools%20Threat%20Protection%20Essentials/Analytic%20Rules/PowerShell-Abuse.yaml
Version	1.0.5
Arm template	7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d.json

KQL

let Lookback = 1h;
let EncodedFlagRegex = @'(?i)(^|\s)-(encodedcommand|enco|enc|ec|e)\b';
let EncodedValueRegex = @'(?i)(^|\s)-(encodedcommand|enco|enc|ec|e)\b\s?([^\s]+)';
let AllowlistedParents = dynamic([
  "SqlServer.exe", "ManagementStudio.exe", "devenv.exe",
  "ccmexec.exe", "SMSAgent.exe"
]);
let DownloadCradlePatterns = dynamic([
  "Net.WebClient", "WebRequest", "DownloadString", "DownloadFile",
  "IEX", "Invoke-Expression", "Invoke-RestMethod", "Start-BitsTransfer"
]);
let MDE_Results =
  DeviceProcessEvents
  | where Timestamp >= ago(Lookback)
  | where FileName in~ ("powershell.exe", "pwsh.exe")
  | where ProcessCommandLine matches regex EncodedFlagRegex
  | where not(InitiatingProcessFileName has_any (AllowlistedParents))
  | extend EncodedCommand = extract(EncodedValueRegex, 3, ProcessCommandLine)
  | extend DecodedCommand = replace_string(
      base64_decode_tostring(EncodedCommand), '\0', ''
    )
  | extend
      HasDownloadCradle = DecodedCommand has_any (DownloadCradlePatterns),
      AccountName = InitiatingProcessAccountName,
      AccountDomain = InitiatingProcessAccountDomain,
      HostName = DeviceName,
      EventTime = Timestamp
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, DecodedCommand, InitiatingProcessFileName,
      HasDownloadCradle;
let SecEvent_Results =
  SecurityEvent
  | where TimeGenerated >= ago(Lookback)
  | where EventID == 4688
  | where NewProcessName endswith "\\powershell.exe"
      or NewProcessName endswith "\\pwsh.exe"
  | where CommandLine matches regex EncodedFlagRegex
  | where not(ParentProcessName has_any (AllowlistedParents))
  | extend EncodedCommand = extract(EncodedValueRegex, 3, CommandLine)
  | extend DecodedCommand = replace_string(
      base64_decode_tostring(EncodedCommand), '\0', ''
    )
  | extend
      HasDownloadCradle = DecodedCommand has_any (DownloadCradlePatterns),
      AccountName = SubjectUserName,
      AccountDomain = SubjectDomainName,
      HostName = Computer,
      EventTime = TimeGenerated,
      ProcessCommandLine = CommandLine,
      InitiatingProcessFileName = ParentProcessName
  | project EventTime, HostName, AccountName, AccountDomain,
      ProcessCommandLine, DecodedCommand, InitiatingProcessFileName,
      HasDownloadCradle;
union MDE_Results, SecEvent_Results
| extend RiskScore = iif(HasDownloadCradle, 2, 1)
| sort by RiskScore desc, EventTime desc

YAML

name: PowerShell Encoded Command Execution (Living off the Land)
triggerOperator: gt
query: |
  let Lookback = 1h;
  let EncodedFlagRegex = @'(?i)(^|\s)-(encodedcommand|enco|enc|ec|e)\b';
  let EncodedValueRegex = @'(?i)(^|\s)-(encodedcommand|enco|enc|ec|e)\b\s?([^\s]+)';
  let AllowlistedParents = dynamic([
    "SqlServer.exe", "ManagementStudio.exe", "devenv.exe",
    "ccmexec.exe", "SMSAgent.exe"
  ]);
  let DownloadCradlePatterns = dynamic([
    "Net.WebClient", "WebRequest", "DownloadString", "DownloadFile",
    "IEX", "Invoke-Expression", "Invoke-RestMethod", "Start-BitsTransfer"
  ]);
  let MDE_Results =
    DeviceProcessEvents
    | where Timestamp >= ago(Lookback)
    | where FileName in~ ("powershell.exe", "pwsh.exe")
    | where ProcessCommandLine matches regex EncodedFlagRegex
    | where not(InitiatingProcessFileName has_any (AllowlistedParents))
    | extend EncodedCommand = extract(EncodedValueRegex, 3, ProcessCommandLine)
    | extend DecodedCommand = replace_string(
        base64_decode_tostring(EncodedCommand), '\0', ''
      )
    | extend
        HasDownloadCradle = DecodedCommand has_any (DownloadCradlePatterns),
        AccountName = InitiatingProcessAccountName,
        AccountDomain = InitiatingProcessAccountDomain,
        HostName = DeviceName,
        EventTime = Timestamp
    | project EventTime, HostName, AccountName, AccountDomain,
        ProcessCommandLine, DecodedCommand, InitiatingProcessFileName,
        HasDownloadCradle;
  let SecEvent_Results =
    SecurityEvent
    | where TimeGenerated >= ago(Lookback)
    | where EventID == 4688
    | where NewProcessName endswith "\\powershell.exe"
        or NewProcessName endswith "\\pwsh.exe"
    | where CommandLine matches regex EncodedFlagRegex
    | where not(ParentProcessName has_any (AllowlistedParents))
    | extend EncodedCommand = extract(EncodedValueRegex, 3, CommandLine)
    | extend DecodedCommand = replace_string(
        base64_decode_tostring(EncodedCommand), '\0', ''
      )
    | extend
        HasDownloadCradle = DecodedCommand has_any (DownloadCradlePatterns),
        AccountName = SubjectUserName,
        AccountDomain = SubjectDomainName,
        HostName = Computer,
        EventTime = TimeGenerated,
        ProcessCommandLine = CommandLine,
        InitiatingProcessFileName = ParentProcessName
    | project EventTime, HostName, AccountName, AccountDomain,
        ProcessCommandLine, DecodedCommand, InitiatingProcessFileName,
        HasDownloadCradle;
  union MDE_Results, SecEvent_Results
  | extend RiskScore = iif(HasDownloadCradle, 2, 1)
  | sort by RiskScore desc, EventTime desc
queryFrequency: 1h
description: |
  Detects PowerShell or pwsh.exe launched with encoded command flags
  (-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64
  to obfuscate malicious payloads and bypass script-based controls.
  Risk is elevated when a download cradle pattern is also detected.
  Tune AllowlistedParents for known-safe management tools such as SCCM.
id: 7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d
triggerThreshold: 0
queryPeriod: 1h
version: 1.0.5
kind: Scheduled
status: Available
severity: Medium
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
- connectorId: SecurityEvents
  dataTypes:
  - SecurityEvent
OriginalUri: https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker%20Tools%20Threat%20Protection%20Essentials/Analytic%20Rules/PowerShell-Abuse.yaml
relevantTechniques:
- T1059.001
- T1027
tactics:
- Execution
- DefenseEvasion
entityMappings:
- fieldMappings:
  - identifier: FullName
    columnName: HostName
  entityType: Host
- fieldMappings:
  - identifier: Name
    columnName: AccountName
  - identifier: NTDomain
    columnName: AccountDomain
  entityType: Account
- fieldMappings:
  - identifier: CommandLine
    columnName: ProcessCommandLine
  entityType: Process

ARM

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "workspace": {
      "type": "String"
    }
  },
  "resources": [
    {
      "apiVersion": "2024-01-01-preview",
      "id": "[concat(resourceId('Microsoft.OperationalInsights/workspaces/providers', parameters('workspace'), 'Microsoft.SecurityInsights'),'/alertRules/7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d')]",
      "kind": "Scheduled",
      "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d')]",
      "properties": {
        "alertRuleTemplateName": "7b2f4d1a-9c3e-4f72-8b1d-3e6a9f2c4b8d",
        "customDetails": null,
        "description": "Detects PowerShell or pwsh.exe launched with encoded command flags\n(-EncodedCommand, -enc, -ec, -enco). Attackers encode commands in Base64\nto obfuscate malicious payloads and bypass script-based controls.\nRisk is elevated when a download cradle pattern is also detected.\nTune AllowlistedParents for known-safe management tools such as SCCM.\n",
        "displayName": "PowerShell Encoded Command Execution (Living off the Land)",
        "enabled": true,
        "entityMappings": [
          {
            "entityType": "Host",
            "fieldMappings": [
              {
                "columnName": "HostName",
                "identifier": "FullName"
              }
            ]
          },
          {
            "entityType": "Account",
            "fieldMappings": [
              {
                "columnName": "AccountName",
                "identifier": "Name"
              },
              {
                "columnName": "AccountDomain",
                "identifier": "NTDomain"
              }
            ]
          },
          {
            "entityType": "Process",
            "fieldMappings": [
              {
                "columnName": "ProcessCommandLine",
                "identifier": "CommandLine"
              }
            ]
          }
        ],
        "OriginalUri": "https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Attacker%20Tools%20Threat%20Protection%20Essentials/Analytic%20Rules/PowerShell-Abuse.yaml",
        "query": "let Lookback = 1h;\nlet EncodedFlagRegex = @'(?i)(^|\\s)-(encodedcommand|enco|enc|ec|e)\\b';\nlet EncodedValueRegex = @'(?i)(^|\\s)-(encodedcommand|enco|enc|ec|e)\\b\\s?([^\\s]+)';\nlet AllowlistedParents = dynamic([\n  \"SqlServer.exe\", \"ManagementStudio.exe\", \"devenv.exe\",\n  \"ccmexec.exe\", \"SMSAgent.exe\"\n]);\nlet DownloadCradlePatterns = dynamic([\n  \"Net.WebClient\", \"WebRequest\", \"DownloadString\", \"DownloadFile\",\n  \"IEX\", \"Invoke-Expression\", \"Invoke-RestMethod\", \"Start-BitsTransfer\"\n]);\nlet MDE_Results =\n  DeviceProcessEvents\n  | where Timestamp >= ago(Lookback)\n  | where FileName in~ (\"powershell.exe\", \"pwsh.exe\")\n  | where ProcessCommandLine matches regex EncodedFlagRegex\n  | where not(InitiatingProcessFileName has_any (AllowlistedParents))\n  | extend EncodedCommand = extract(EncodedValueRegex, 3, ProcessCommandLine)\n  | extend DecodedCommand = replace_string(\n      base64_decode_tostring(EncodedCommand), '\\0', ''\n    )\n  | extend\n      HasDownloadCradle = DecodedCommand has_any (DownloadCradlePatterns),\n      AccountName = InitiatingProcessAccountName,\n      AccountDomain = InitiatingProcessAccountDomain,\n      HostName = DeviceName,\n      EventTime = Timestamp\n  | project EventTime, HostName, AccountName, AccountDomain,\n      ProcessCommandLine, DecodedCommand, InitiatingProcessFileName,\n      HasDownloadCradle;\nlet SecEvent_Results =\n  SecurityEvent\n  | where TimeGenerated >= ago(Lookback)\n  | where EventID == 4688\n  | where NewProcessName endswith \"\\\\powershell.exe\"\n      or NewProcessName endswith \"\\\\pwsh.exe\"\n  | where CommandLine matches regex EncodedFlagRegex\n  | where not(ParentProcessName has_any (AllowlistedParents))\n  | extend EncodedCommand = extract(EncodedValueRegex, 3, CommandLine)\n  | extend DecodedCommand = replace_string(\n      base64_decode_tostring(EncodedCommand), '\\0', ''\n    )\n  | extend\n      HasDownloadCradle = DecodedCommand has_any (DownloadCradlePatterns),\n      AccountName = SubjectUserName,\n      AccountDomain = SubjectDomainName,\n      HostName = Computer,\n      EventTime = TimeGenerated,\n      ProcessCommandLine = CommandLine,\n      InitiatingProcessFileName = ParentProcessName\n  | project EventTime, HostName, AccountName, AccountDomain,\n      ProcessCommandLine, DecodedCommand, InitiatingProcessFileName,\n      HasDownloadCradle;\nunion MDE_Results, SecEvent_Results\n| extend RiskScore = iif(HasDownloadCradle, 2, 1)\n| sort by RiskScore desc, EventTime desc\n",
        "queryFrequency": "PT1H",
        "queryPeriod": "PT1H",
        "severity": "Medium",
        "status": "Available",
        "subTechniques": [
          "T1059.001"
        ],
        "suppressionDuration": "PT1H",
        "suppressionEnabled": false,
        "tactics": [
          "DefenseEvasion",
          "Execution"
        ],
        "techniques": [
          "T1027",
          "T1059"
        ],
        "templateVersion": "1.0.5",
        "triggerOperator": "GreaterThan",
        "triggerThreshold": 0
      },
      "type": "Microsoft.OperationalInsights/workspaces/providers/alertRules"
    }
  ]
}