title: Suspicious Powershell No File or Command
id: b66474aa-bd92-4333-a16c-298155b120df
status: experimental
description: Detects suspicious powershell execution that ends with a common flag instead of a command or a filename to execute (could be a sign of implicit execution that uses files in WindowsApps directory)
author: 'pH-T, Florian Roth'
references:
  - https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/
date: 2022/04/08
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|endswith:
      - ' -windowstyle hidden"'
      - ' -windowstyle hidden'
      - " -windowstyle hidden'"
      - ' -w hidden"'
      - ' -w hidden'
      - " -w hidden'"
      - ' -ep bypass"'
      - ' -ep bypass'
      - " -ep bypass'"
      - ' -noni"'
      - ' -noni'
      - " -noni'"
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.persistence
  - attack.t1053.005
  - attack.t1059.001
