Powershell Encoded Command

[rule]
description = """
Detects process events where the process is Powershell (pwsh) or a shell interpreter (sh, bash, zsh) with the encoded
command flag set in the process arguments. Powershell usage on macOS is extremely rare but usage of Powershell with the
encoded command flag, used for executing base64 encoded command strings, is almost always inherently malicious.
"""
id = "4abb4f46-2066-4769-b073-dca491067e1b"
license = "Elastic License v2"
name = "Powershell Encoded Command"
os_list = ["macos"]
version = "1.0.22"

query = '''
process where event.type == "start" and process.args in~ ("-EncodedCommand", "-enc") and
 (process.name in ("sh", "bash", "zsh", "pwsh", "dash", "csh", "tcsh", "ksh", "tclsh", "fish") or process.name like "tclsh*") and
 not process.args like "/Applications/Visual Studio Code.app/*" and
 not process.executable like "/Applications/Docker.app/Contents/Resources/bin/docker" and
 not process.parent.executable in ("/Applications/Docker.app/Contents/Resources/bin/com.docker.cli",
                                   "/Applications/VSCodium.app/Contents/Frameworks/VSCodium Helper.app/Contents/MacOS/VSCodium Helper",
                                   "/Applications/Cursor.app/Contents/Frameworks/Cursor Helper.app/Contents/MacOS/Cursor Helper",
                                   "/Applications/Visual Studio Code.app/Contents/Frameworks/Code Helper.app/Contents/MacOS/Code Helper",
                                   "/Applications/Docker.app/Contents/Resources/bin/docker") and
 not process.parent.code_signature.team_id in ("UBF8T346G9", "83Z2LHX6XW") and
 not process.Ext.effective_parent.name == "electron" and
 not ((process.name == "zsh" and process.parent.name == "zsh") or
      (process.name == "pwsh" and process.parent.name == "pwsh") or
      (process.name == "pwsh" and process.parent.name == "Code Helper"))
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.11.0"