PowerShell -EncodedCommand: eleven ways to spell one parameter
A rule looking for "-encodedcommand" misses most of the variants. Tested on pwsh 7.6, with a validated Sigma rule, measured false positives and a triage routine.
A rule looking for "-encodedcommand" misses most of the variants. Tested on pwsh 7.6, with a validated Sigma rule, measured false positives and a triage routine.