FROM logs-windows.powershell_operational* metadata _id, _version, _index
| WHERE event.code == "4104"

// Replace repeated spaces used for formatting after a new line with a single space to reduce FPs
| EVAL dedup_space_script_block = REPLACE(powershell.file.script_block_text, """\n\s+""", "\n ")

// Look for scripts with more than 1000 chars that contain a related keyword
| EVAL script_len = LENGTH(dedup_space_script_block)
| WHERE script_len > 1000

// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
| EVAL replaced_with_fire = REPLACE(dedup_space_script_block, """[\s\$\{\}\+\@\=\(\)\^\\\"~\[\]\?\.]""", "🔥")

// Count the occurrence of numbers and their proportion to the total chars in the script
| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
| EVAL proportion = special_count::double / script_len::double

// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
| KEEP special_count, script_len, proportion, dedup_space_script_block, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id

// Filter for scripts with a 75%+ proportion of numbers
| WHERE proportion > 0.75