MALWARE: FIND IT BEFORE IT FINDS YOU!

PowerShell can handle certain characters that Cmd.exe cannot. Attackers use encoding to obfuscate the actual intent of the command. These queries find any PowerShell instances that have a base64 encoded command line. process.file.name=powershell.exe AND operation:1 AND (process.cmd_line:"*-enc*" OR process.cmd_line:"*encoded*") ................
................