{
  "title": "Suspicious PowerShell Encoded Command",
  "description": "Detects PowerShell process creation with an encoded-command argument.",
  "logsource": {
    "product": "windows",
    "category": "process_creation"
  },
  "detection": {
    "selection_image": {
      "Image|endswith": [
        "\\powershell.exe",
        "\\pwsh.exe"
      ]
    },
    "selection_flag": {
      "CommandLine|contains": [
        " -enc ",
        " -EncodedCommand "
      ]
    },
    "condition": "all of selection_*"
  },
  "attack_techniques": [
    "T1059.001"
  ],
  "false_positives": [
    "Authorized administrative scripts using encoded commands"
  ],
  "severity": "medium"
}