Create GEN_PowerShell.yar

malware/GEN_PowerShell.yar

+
+rule GEN_PowerShell {
+	meta:
+    	description = "Generic PowerShell Malware Rule"
+      author = "https://github.com/interleaved"
+    strings:
+    	$s1 = "powershell"
+        $s2 = "-ep bypass" nocase
+        $s3 = "-nop" nocase
+        $s10 = "-executionpolicy bypass" nocase
+        $s4 = "-win hidden" nocase
+        $s5 = "-windowstyle hidden" nocase
+        $s11 = "-w hidden" nocase
+        /*$s6 = "-noni" fullword ascii*/
+        /*$s7 = "-noninteractive" fullword ascii*/
+        $s8 = "-enc" nocase
+        $s9 = "-encodedcommand" nocase
+    condition:
+    	$s1 and (($s2 or $s3 or $s10) and ($s4 or $s5 or $s11) and ($s8 or $s9))
+}