Accelerating SOC Response: 3 Process Fixes to Unlock Tier 1 Productivity

---
title: Suspicious PowerShell Encoded Command
id: 5a4b6c9d-2e1f-4a3b-8c7d-9e0f1a2b3c4d
status: experimental
description: Detects the use of encoded commands in PowerShell, which is commonly used by attackers to obfuscate malicious payloads.
references:
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.execution
  - attack.t1059.001
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - ' -enc '
      - ' -EncodedCommand '
condition: selection
falsepositives:
  - Legitimate software deployment scripts using encoded parameters
level: high
---
title: Suspicious Process Injection via lsass
id: b3c2d1e0-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects potential credential dumping by monitoring for processes accessing lsass.exe with specific access masks.
references:
  - https://attack.mitre.org/techniques/T1003/001/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: '\lsass.exe'
    GrantedAccess|contains:
      - '0x1010'
      - '0x143a'
      - '0x1410'
  filter:
    SourceImage|endswith:
      - '\svchost.exe'
      - '\lsass.exe'
      - '\wininit.exe'
      - '\services.exe'
condition: selection and not filter
falsepositives:
  - Legitimate antivirus or EDR products accessing memory
level: critical
---
title: Potential Lateral Movement via RDP
id: c1b2a3d4-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects inbound network connections on port 3389 (RDP) which may indicate lateral movement attempts.
references:
  - https://attack.mitre.org/techniques/T1021/001/
author: Security Arsenal
date: 2026/03/29
tags:
  - attack.lateral_movement
  - attack.t1021.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 3389
    Initiated: 'true'
  filter:
    SourceIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
condition: selection and not filter
falsepositives:
  - Legitimate administrative remote desktop sessions from internal ranges
level: medium

// Hunt for Encoded PowerShell Commands
DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName =~ "powershell.exe"
| where ProcessCommandLine contains " -enc " or ProcessCommandLine contains " -EncodedCommand "
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc


// Identify External RDP Connections (Lateral Movement)
DeviceNetworkEvents
| where Timestamp > ago(12h)
| where RemotePort == 3389
| where ActionType == "InboundConnectionAccepted"
| project Timestamp, DeviceName, RemoteIP, RemotePort, LocalIP, InitiatingProcessAccountName
| extend IsInternal = iff(RemIP startswith "10." or RemoteIP startswith "192.168." or RemoteIP startswith "172.", true, false)
| where IsInternal == false

-- Hunt for suspicious PowerShell processes with encoded arguments
SELECT Pid, Name, CommandLine, Exe, Username, StartTime
FROM pslist()
WHERE Name =~ 'powershell.exe'
  AND (CommandLine =~ '-enc' OR CommandLine =~ '-EncodedCommand')


-- Hunt for modifications to Run Keys (Persistence)
SELECT Key.Path, Key.ModTime, Key.Data.Name, Key.Data.Data
FROM read_reg_key(globs=['HKLM\Software\Microsoft\Windows\CurrentVersion\Run\**',
                        'HKCU\Software\Microsoft\Windows\CurrentVersion\Run\**'])
WHERE Key.Data.Name

<#
.SYNOPSIS
    Audit local system for common security misconfigurations.
.DESCRIPTION
    Checks for unsigned drivers, weak SMB configurations, and unusual scheduled tasks.
#>

Write-Host "[+] Starting Local Security Audit..."

# Check for SMBv1 (Legacy Protocol)
$smbv1 = Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol
if ($smbv1.EnableSMB1Protocol -eq $true) {
    Write-Host "[WARNING] SMBv1 is enabled. Consider disabling to reduce attack surface." -ForegroundColor Yellow
} else {
    Write-Host "[OK] SMBv1 is disabled." -ForegroundColor Green
}

# Check for unusual scheduled tasks
$suspiciousTasks = Get-ScheduledTask | Where-Object { $_.Actions.Execute -like "*powershell*" -and $_.Actions.Arguments -like "*encoded*" }
if ($suspiciousTasks) {
    Write-Host "[WARNING] Found scheduled tasks with encoded PowerShell arguments:" -ForegroundColor Red
    $suspiciousTasks | Select-Object TaskName, TaskPath
} else {
    Write-Host "[OK] No suspicious scheduled tasks found." -ForegroundColor Green
}

Write-Host "[+] Audit Complete."