{"id":"1816994b-42e1-4fb1-afd2-134d88184f71","title":"PowerShell Base64 Encoded WMI Classes","description":"Detects calls to base64 encoded WMI class such as \"Win32_ShadowCopy\", \"Win32_ScheduledJob\", etc.","author":"Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-30","modified":"","tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"technique_ids":["T1027","T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml","source_sha256":"8cbaac4bf02c07046bee961f7190b5f70d2fba38f260121f56adb5104b2aa987","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Base64 Encoded WMI Classes\nid: 1816994b-42e1-4fb1-afd2-134d88184f71\nrelated:\n    - id: 47688f1b-9f51-4656-b013-3cc49a166a36\n      type: obsolete\nstatus: test\ndescription: Detects calls to base64 encoded WMI class such as \"Win32_ShadowCopy\", \"Win32_ScheduledJob\", etc.\nreferences:\n    - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar\nauthor: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-01-30\ntags:\n    - attack.execution\n    - attack.stealth\n    - attack.t1059.001\n    - attack.t1027\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_cli_shadowcopy:\n        # Win32_ShadowCopy\n        CommandLine|contains:\n            - 'VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ'\n            - 'cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA'\n            - 'XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A'\n            - 'V2luMzJfU2hhZG93Y29we'\n            - 'dpbjMyX1NoYWRvd2NvcH'\n            - 'XaW4zMl9TaGFkb3djb3B5'\n    selection_cli_scheduledJob:\n        # Win32_ScheduledJob\n        CommandLine|contains:\n            - 'VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA'\n            - 'cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA'\n            - 'XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg'\n            - 'V2luMzJfU2NoZWR1bGVkSm9i'\n            - 'dpbjMyX1NjaGVkdWxlZEpvY'\n            - 'XaW4zMl9TY2hlZHVsZWRKb2'\n    selection_cli_process:\n        # Win32_Process\n        CommandLine|contains:\n            - 'VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw'\n            - 'cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA'\n            - 'XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA'\n            - 'V2luMzJfUHJvY2Vzc'\n            - 'dpbjMyX1Byb2Nlc3'\n            - 'XaW4zMl9Qcm9jZXNz'\n    selection_cli_useraccount:\n        # Win32_UserAccount\n        CommandLine|contains:\n            - 'VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A'\n            - 'cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA'\n            - 'XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA'\n            - 'V2luMzJfVXNlckFjY291bn'\n            - 'dpbjMyX1VzZXJBY2NvdW50'\n            - 'XaW4zMl9Vc2VyQWNjb3Vud'\n    selection_cli_loggedonuser:\n        # Win32_LoggedOnUser\n        CommandLine|contains:\n            - 'VwBpAG4AMwAyAF8ATABvAGcAZwBlAGQATwBuAFUAcwBlAHIA'\n            - 'cAaQBuADMAMgBfAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByA'\n            - 'XAGkAbgAzADIAXwBMAG8AZwBnAGUAZABPAG4AVQBzAGUAcg'\n            - 'V2luMzJfTG9nZ2VkT25Vc2Vy'\n            - 'dpbjMyX0xvZ2dlZE9uVXNlc'\n            - 'XaW4zMl9Mb2dnZWRPblVzZX'\n    condition: selection_img and 1 of selection_cli_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/1816994b-42e1-4fb1-afd2-134d88184f71.json","kind":"sigma"}