title: Powershell delayed execution via ping command
status: experimental
description: Powershell delayed execution via ping command
author: Joe Security
date: 2020-03-17
id: 200066
threatname:
behaviorgroup: 5
classification: 8
mitreattack:

logsource:
      category: process_creation
      product: windows
detection:
      selection:      
          CommandLine:
              - '*ping -n * & powershell.exe -executionpolicy bypass -noninteractive -windowstyle hidden*'
      condition: selection
level: critical