{"id":"584bca0f-3608-4402-80fd-4075ff6072e3","title":"Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image","description":"Detects potential commandline obfuscation using unicode characters.\nAdversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.\n","author":"frack113, Florian Roth (Nextron Systems), Josh Nickels","status":"test","level":"high","date":"2024-09-02","modified":"2025-05-30","tags":["attack.stealth","attack.t1027"],"technique_ids":["T1027"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http"],"source_path":"rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml","source_sha256":"9645afda651aa60f64219059d81e2e29e166ea4a4975b28218926c8968c5da58","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_cli_obfuscation_unicode_img.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image\nid: 584bca0f-3608-4402-80fd-4075ff6072e3\nrelated:\n    - id: e0552b19-5a83-4222-b141-b36184bb8d79\n      type: similar\n    - id: ad691d92-15f2-4181-9aa4-723c74f9ddc3 # RTLO\n      type: similar\n    - id: 2c0d2d7b-30d6-4d14-9751-7b9113042ab9\n      type: obsolete\nstatus: test\ndescription: |\n    Detects potential commandline obfuscation using unicode characters.\n    Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.\nreferences:\n    - https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http\nauthor: frack113, Florian Roth (Nextron Systems), Josh Nickels\ndate: 2024-09-02\nmodified: 2025-05-30\ntags:\n    - attack.stealth\n    - attack.t1027\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        Image|endswith:\n            - '\\cmd.exe'\n            - '\\cscript.exe'\n            - '\\powershell.exe'\n            - '\\powershell_ise.exe'\n            - '\\pwsh.exe'\n            - '\\wscript.exe'\n        OriginalFileName:\n            - 'Cmd.EXE'\n            - 'cscript.exe'\n            - 'PowerShell.EXE'\n            - 'PowerShell_ISE.EXE'\n            - 'pwsh.dll'\n            - 'wscript.exe'\n    selection_special_chars:\n        CommandLine|contains:\n            # spacing modifier letters that get auto-replaced\n            - 'ˣ' # 0x02E3\n            - '˪' # 0x02EA\n            - 'ˢ' # 0x02E2\n            # Forward slash alternatives\n            - '∕' # 0x22FF\n            - '⁄' # 0x206F\n            # Hyphen alternatives\n            - '―' # 0x2015\n            - '—' # 0x2014\n            # Whitespace that don't work as path separator\n            - ' ' # 0x00A0\n            # Other\n            - '¯'\n            - '®'\n            - '¶'\n            # Unicode whitespace characters\n            - '⠀' # Braille Pattern Blank (Unicode: U+2800)\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"}],"data_path":"data/detection-rules/584bca0f-3608-4402-80fd-4075ff6072e3.json","kind":"sigma"}