from logs-windows.powershell_operational* metadata _id, _version, _index
| where event.code == "4104" and powershell.file.script_block_text like "*{0}*"

// Filter out smaller scripts that are unlikely to implement obfuscation using the patterns we are looking for
| eval Esql.script_block_length = length(powershell.file.script_block_text)
| where Esql.script_block_length > 500

// replace the patterns we are looking for with the 🔥 emoji to enable counting them
// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
| eval Esql.script_block_tmp = replace(
    powershell.file.script_block_text,
    """((\{\d+\}){2,}["']\s?-f|::Format[^\{]+(\{\d+\}){2,})""",
    "🔥"
)

// count how many patterns were detected by calculating the number of 🔥 characters inserted
| eval Esql.script_block_pattern_count = length(Esql.script_block_tmp) - length(replace(Esql.script_block_tmp, "🔥", ""))

// keep the fields relevant to the query, although this is not needed as the alert is populated using _id
| keep
    Esql.script_block_pattern_count,
    Esql.script_block_length,
    Esql.script_block_tmp,
    powershell.file.script_block_text,
    powershell.file.script_block_id,
    file.path,
    file.directory,
    powershell.sequence,
    powershell.total,
    _id,
    _index,
    host.name,
    agent.id,
    user.id

// Filter for scripts that match the pattern at least four times
| where Esql.script_block_pattern_count >= 4

// Exclude Noisy Patterns

// Icinga Framework
| where not file.directory == "C:\\Program Files\\WindowsPowerShell\\Modules\\icinga-powershell-framework\\cache"
  // ESQL requires this condition, otherwise it only returns matches where file.directory exists.
  or file.directory IS NULL

| where not (powershell.file.script_block_text LIKE "*GitBranchStatus*" AND 
    powershell.file.script_block_text LIKE "*$s.BranchBehindStatusSymbol.Text*")
| where not
    // https://wtfbins.wtf/17
    (
        (powershell.file.script_block_text like "*sentinelbreakpoints*" or
         powershell.file.script_block_text like "*:::::\\\\windows\\\\sentinel*")
        and
        (powershell.file.script_block_text like "*$local:Bypassed*" or
         powershell.file.script_block_text like "*origPSExecutionPolicyPreference*")
    )