Emulating T1059.001 until the detection actually fires

Four variants of the same PowerShell technique, three of which walked past a rule that looked fine on paper. Notes from a purple team afternoon.

Security Artifacts

9 August 20264 min readUpdated 15 October 202689 reads

ATT&CK: T1027 T1059.001 TA0002
Filed under: powershell detection-engineering sigma atomic-red-team amsi guide

The rule looked reasonable. It matched encoded PowerShell commands, it had been running for a month, and it had never produced a false positive. That last part should have been the tell.

This is the afternoon spent proving it only caught the version of the technique I happened to have in mind when I wrote it.

The rule under test