PowerShell script to check for the presence of Invoke-Command, such as that ran by Empire and other fileless malware.

Check-For-PowerShell-Invoke-Command.ps1

$result = Get-WinEvent -FilterHashTable @{LogName="Microsoft-Windows-Sysmon/Operational"; StartTime=(get-date).AddHours(-1); EndTime=(Get-Date); ID=1}| ?{$_.Message -match "Invoke-Command" }
if($result.Count -gt 0) {
	# PUT YOUR SCRIPT ACTION HERE WHEN DETECTED IN THE LAST HOUR
}