BIOC
Informational
✕
PowerShell script executed from a temporary directory
An attacker may try to avoid detection by executing a PowerShell script from a temporary directory.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Collection
- Status:
- Enabled
ATT&CK tactics: Collection (TA0009)
ATT&CK techniques: Data Staged: Local Data Staging (T1074.001)
Indicator:
Process action type = execution AND target process path = *tmp* , *temp* AND target process cmd =~ (?i)(.*-(enc|EncodedCommand|ec|en) [A-Za-z0-9]{5,}=|[windowstyle^ ]{1,12}?hidden|(noni|noninteractive)|n(oprofile|op)|e[xecutionpolicy]{1,15} (bypass|unrestricted|hidden)|(eq|noexit)).* AND target process cmd !=~ .*(embedding|comment|wdenable|EnableService|-energy -auto|NetworkDiagnosticsPNI).* Host host os = windows
Preventable: yes