PowerShell Decompress Commands

Title: PowerShell Decompress Commands
Status: test
Description:A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.
References:
  -https://github.com/OTRF/detection-hackathon-apt29/issues/8
  -https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.A.3_09F29912-8E93-461E-9E89-3F06F6763383.md
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
modified:2022-12-25
Tags:

• -'attack.stealth'
• -'attack.t1140'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection_4103:
    Payload|contains: 'Expand-Archive'
  condition:selection_4103
Falsepositives:
  -Unknown
Level: informational