Potential Obfuscated PowerShell Script

[rule]
description = """
Identifies the execution of PowerShell with potentially obfuscated content. This behavior is often observed during
malware installation leveraging PowerShell.
"""
id = "f4db84b1-13d8-432d-999a-54a09784e62b"
license = "Elastic License v2"
name = "Potential Obfuscated PowerShell Script"
os_list = ["windows"]
version = "1.0.5"

query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and
 process.Ext.api.parameters.app_name == "PowerShell" and
(
  process.Ext.api.parameters.buffer regex """.*(\"\{[0-9]{1,2}\}\{[0-9]{1,2}\}\{[0-9]{1,2}\}|['\"] {0,2}\+ {0,2}['\"][^$]{1,25}['\"]{0,2}\+ {0,2}['\"][^$]{1,25}['\"]\+['\"][^$]{1,25}['\"]\+['\"]).*""" or
  process.Ext.api.parameters.buffer regex~ """.*\.\"s(`+e`*t`*v`*a`*l`*u`*e)|(`*e`+t`*v`*a`*l`*u`*e)|(`*e`*t`+v`*a`*l`*u`*e)|(`*e`*t`*v`+a`*l`*u`*e)|(`*e`*t`*v`*a`+l`*u`*e)|(`*e`*t`*v`*a`*l`+u`*e)|(`*e`*t`*v`*a`*l`*u`+e).*"""
) and
not (user.id == "S-1-5-18" and process.Ext.api.parameters.content_name == "C:\\Install-Beats.ps1" and process.Ext.api.parameters.buffer like "*Install-Beat($ElasticAgent)*") and
not process.Ext.api.parameters.buffer : 
               ("*:::::\\windows\\sentinel\\*", "*<#sentinelbreakpoints#>*", "*$merged_stderr*", "*$branchStatusTextSpan.Text*") and
not (user.id == "S-1-5-18" and process.Ext.api.parameters.content_name : "C:\\WINDOWS\\CCM\\*.ps1") and
not process.Ext.api.parameters.content_name : ("C:\\Program Files\\Microsoft Azure AD Connect Health Agent\\Products\\AdFederationService\\AdfsDiagnostics\\AdfsToolbox\\diagnosticsModule\\Private\\CommonHealthChecks.ps1") and
not process.parent.executable : "C:\\Program Files\\ConEmu\\ConEmu\\ConEmuC64.exe"
'''

min_endpoint_version = "8.16.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"