src/Private/Patterns/SuspiciousCommandPatterns.txt
|
-enc
-encodedcommand frombase64string downloadstring downloadfile invoke-expression iex invoke-webrequest bitsadmin certutil -urlcache certutil.exe -decode mshta regsvr32 /s /u rundll32 javascript wmic process call create vssadmin delete bcdedit /set wbadmin delete net user /add schtasks /create add-mppreference -exclusionpath set-mppreference -disable invoke-mimikatz sekurlsa lsass nltest reg save hklm\sam comsvcs.dll minidump hidden -w hidden -windowstyle hidden nop -w hidden psexec ngrok anydesk rclone megacmd |