Building Tomorrow’s AI-Powered SOC
for Today’s Organizations

🧠 AvicennAI Insight:
User jane.doe executed an obfuscated PowerShell script that attempted to access LSASS memory — a technique often used for credential dumping. The process was initiated shortly after an unusual login from an external IP (89.45.22.101).
📄 Reasoning:
The script matches patterns observed in previous Mimikatz-based attacks. This activity aligns with MITRE ATT&CK technique T1003.001. Notably, the same user was active on two additional hosts within a 15-minute window, indicating possible lateral movement.
✅ Suggested Action:
Isolate the host to prevent further spread, suspend the user account, and initiate a credential reset. Review other endpoints for similar activity.

title: PowerShell Encoded Command Execution
id: z8koxi
status: experimental
description: Detects suspicious PowerShell execution patterns that may indicate malicious activity, such as encoded commands or attempts to access sensitive system processes.
date: 2025/04/11
references:
    - https://attack.mitre.org/
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        CommandLine|contains:
            - 'powershell.exe -enc'
            - 'cmd.exe /c'
            - 'rundll32.exe'
            - 'regsvr32.exe'
        ParentImage|endswith:
            - '\explorer.exe'
            - '\services.exe'
    condition: selection
falsepositives:
    - Legitimate administrative activities
    - Authorized system operations
level: high
tags:
    - attack.execution
    - attack.t1059