FROM .alerts-security.* metadata _id
// Filter for PowerShell related alerts
| WHERE kibana.alert.rule.name LIKE "*PowerShell*"
// As alerts don't have non-ECS fields, parse the script block ID using GROK
| GROK message "ScriptBlock ID: (?<powershell.file.script_block_id>.+)"
| WHERE powershell.file.script_block_id IS NOT NULL
| KEEP kibana.alert.rule.name, powershell.file.script_block_id, _id
// Count distinct alerts and filter for matches above the threshold
| STATS distinct_alerts = COUNT_DISTINCT(kibana.alert.rule.name), rules_triggered = VALUES(kibana.alert.rule.name), alert_ids = VALUES(_id) BY powershell.file.script_block_id
| WHERE distinct_alerts >= 5
Install detection rules in Elastic Security
Detect Potential Malicious PowerShell Based on Alert Correlation in the Elastic Security detection engine by installing this rule into your Elastic Stack.
To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).