Suspicious PowerShell Execution
This query identifies suspicious PowerShell execution patterns, including encoded commands and unusual parent processes, which could indicate malicious activity.
#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i
| CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i
| join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])
| table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine])This query uses CrowdStrike Query Language (CQL) to detect suspicious PowerShell activity:
-
Event Filtering:
#event_simpleName=ProcessRollup2 ImageFileName=/\\powershell\\.exe/i- Searches ProcessRollup2 events for any PowerShell executable (case-insensitive) -
Command Line Analysis:
CommandLine=/\s-[eE^]{1,2}[nN][cC][oO][dD][eE][mM][aA][nN][dD^]+\s/i- Uses regex to find encoded command parameters (-EncodedCommand, -enc, etc.) -
User Context:
join({#event_simpleName=UserIdentity}, field=AuthenticationID, include=[UserName])- Enriches results with username information -
Output:
table([aid, UserName, ParentImageFileName, ImageFileName, CommandLine])- Displays key fields for analysis
