cscli scenarios install sigmahq/proc_creation_win_powershell_download_iex1type: trigger2name: sigmahq/proc_creation_win_powershell_download_iex3description: |4 Detects PowerShell download and execution cradles.5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.CommandLine contains '.DownloadString(' || evt.Parsed.CommandLine contains '.DownloadFile(' || evt.Parsed.CommandLine contains 'Invoke-WebRequest ' || evt.Parsed.CommandLine contains 'iwr ') && (evt.Parsed.CommandLine contains ';iex $' || evt.Parsed.CommandLine contains '| IEX' || evt.Parsed.CommandLine contains '|IEX ' || evt.Parsed.CommandLine contains 'I`E`X' || evt.Parsed.CommandLine contains 'I`EX' || evt.Parsed.CommandLine contains 'IE`X' || evt.Parsed.CommandLine contains 'iex ' || evt.Parsed.CommandLine contains 'IEX (' || evt.Parsed.CommandLine contains 'IEX(' || evt.Parsed.CommandLine contains 'Invoke-Expression'))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t10591516 label: "PowerShell Download and Execution Cradles"17 behavior : "windows:audit"18 remediation: false1920scope:21 type: ParentProcessId22 expression: evt.Parsed.ParentProcessId2324