{"id":"b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c","title":"Suspicious PowerShell Encoded Command Patterns","description":"Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-05-24","modified":"2023-01-05","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Other tools that work with encoded scripts in the command line instead of script files"],"references":["https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml","source_sha256":"73510cf74d7c6445509f75194575e55ed6b8319260c1e0f631640f06ab5a9748","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious PowerShell Encoded Command Patterns\nid: b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c\nstatus: test\ndescription: Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains\nreferences:\n    - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-05-24\nmodified: 2023-01-05\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.Exe'\n              - 'pwsh.dll'\n    selection_flags:\n        CommandLine|contains:\n            - ' -e '\n            - ' -en '\n            - ' -enc '\n            - ' -enco'\n    selection_encoded:\n        CommandLine|contains:\n            - ' JAB'\n            - ' SUVYI'\n            - ' SQBFAFgA'\n            - ' aWV4I'\n            - ' IAB'\n            - ' PAA'\n            - ' aQBlAHgA'\n    filter_gcworker:\n        ParentImage|contains:\n            - 'C:\\Packages\\Plugins\\Microsoft.GuestConfiguration.ConfigurationforWindows\\'\n            - '\\gc_worker.exe'\n    condition: all of selection_* and not 1 of filter_*\nfalsepositives:\n    - Other tools that work with encoded scripts in the command line instead of script files\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c.json","kind":"sigma"}