Query: rule covering Detects suspicious PowerShell invocation with a parameter substring
Matching passage: Sigma rule: Detects suspicious PowerShell invocation with a parameter substring. Logsource: windows / process_creation. Rule: title: Suspicious PowerShell Parameter Substring id: 36210e0d-5b19-485d-a087-c096088885f0 status: test description: Detects suspicious PowerShell invocation with a parameter substring references: - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix) date: 2019-01-16 modified: 2022-07-14 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: Image|endswith: - \powershell.exe - \pwsh.exe CommandLine|contains: - ' -windowstyle h ' - ' -windowstyl h' - ' -windowsty h' - ' -windowst h' - ' -windows h' - ' -windo h' - ' -wind h' - ' -win h' - ' -wi h' - ' -win h ' - ' -win hi ' - ' -win hid ' - ' -win hidd ' - ' -win hidde ' - ' -NoPr ' - ' -NoPro ' - ' -NoProf ' - ' -NoProfi ' - ' -NoProfil ' - ' -nonin ' - ' -nonint ' - ' -noninte ' - ' -noninter ' - ' -nonintera ' - ' -noninterac ' - ' -noninteract ' - ' -noninteracti ' - ' -noninteractiv ' - ' -ec ' - ' -encodedComman ' - ' -encodedComma ' - ' -encodedComm ' - ' -encodedCom ' - ' -encodedCo ' - ' -encodedC ' - ' -encoded ' - ' -encode ' - ' -encod ' - ' -enco ' - ' -en ' - ' -executionpolic ' - ' -executionpoli ' - ' -executionpol ' - ' -executionpo ' - ' -executionp ' - ' -execution bypass' - ' -executio bypass' - ' -executi bypass' - ' -execut bypass' - ' -execu bypass' - ' -exec bypass' - ' -exe bypass' - ' -ex bypass' - ' -ep bypass' - ' /windowstyle h ' - ' /windowstyl h' - ' /windowsty h' - ' /windowst h' - ' /windows h' - ' /windo h' - ' /wind h' - ' /win h' - ' /wi h' - ' /win h ' - ' /win hi ' - ' /win hid ' - ' /win hidd ' - ' /win hidde ' - ' /NoPr ' - ' /NoPro ' - ' /NoProf ' - ' /NoProfi ' - ' /NoProfil ' - ' /nonin ' - ' /nonint ' - ' /noninte ' - ' /noninter ' - ' /nonintera ' - ' /noninterac ' - ' /noninteract ' - ' /noninteracti ' - ' /noninteractiv ' - ' /ec ' - ' /encodedComman ' - ' /encodedComma ' - ' /encodedComm ' - ' /encodedCom ' - ' /encodedCo ' - ' /encodedC ' - ' /encoded ' - ' /encode ' - ' /encod ' - ' /enco ' - ' /en ' - ' /executionpolic ' - ' /executionpoli ' - ' /executionpol ' - ' /executionpo ' - ' /executionp ' - ' /execution bypass' - ' /executio bypass' - ' /executi bypass' - ' /execut bypass' - ' /execu bypass' - ' /exec bypass' - ' /exe bypass' - ' /ex bypass' - ' /ep bypass' condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects when a user has potentially entered their password into the username field, which will cause the password to be. Logsource: okta / okta. Rule: title: Potential Okta Password in AlternateID Field id: 91b76b84-8589-47aa-9605-c837583b82a9 status: test description: 'Detects when a user has potentially entered their password into the username field, which will cause the password to be retained in log files. ' references: - https://developer.okta.com/docs/reference/api/system-log/ - https://www.mitiga.io/blog/how-okta-passwords-can-be-compromised-uncovering-a-risk-to-user-data - https://help.okta.com/en-us/Content/Topics/users-groups-profiles/usgp-create-character-restriction.htm author: kelnage date: 2023-04-03 modified: 2026-04-27 tags: - attack.credential-access - attack.t1552 logsource: product: okta service: okta detection: selection: legacyEventType: core.user_auth.login_failed filter_main: actor.alternateId|re: (^0oa.*|[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,10}) condition: selection and not filter_main falsepositives: - Unlikely level: high