Shedule powershell with encoded command parameter

 1title: Shedule powershell with encoded command parameter
 2status: experimental
 3description: Shedule powershell with encoded command parameter
 4author: Joe Security
 5date: 2021-03-08
 6id: 200100
 7threatname: 
 8behaviorgroup: 2
 9classification: 8
10mitreattack:
11
12logsource:
13    category: process_creation
14    product: windows
15detection:
16    selection:
17        CommandLine:
18            - '*schtasks*powershell -ep bypass -e *'
19    condition: selection
20level: critical