{"id":"c86133ad-4725-4bd0-8170-210788e0a7ba","title":"Net WebClient Casing Anomalies","description":"Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-05-24","modified":"2023-01-05","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml","source_sha256":"05771c89660565522d100bd659e42adb15bc5a63a48ab4aa1d1629789cc1e8d3","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Net WebClient Casing Anomalies\nid: c86133ad-4725-4bd0-8170-210788e0a7ba\nstatus: test\ndescription: Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques\nreferences:\n    - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/\nauthor: Florian Roth (Nextron Systems)\ndate: 2022-05-24\nmodified: 2023-01-05\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_encoded:\n        CommandLine|contains:\n            - 'TgBlAFQALgB3AEUAQg'\n            - '4AZQBUAC4AdwBFAEIA'\n            - 'OAGUAVAAuAHcARQBCA'\n            - 'bgBFAHQALgB3AGUAYg'\n            - '4ARQB0AC4AdwBlAGIA'\n            - 'uAEUAdAAuAHcAZQBiA'\n            - 'TgBFAHQALgB3AGUAYg'\n            - 'OAEUAdAAuAHcAZQBiA'\n            - 'bgBlAFQALgB3AGUAYg'\n            - '4AZQBUAC4AdwBlAGIA'\n            - 'uAGUAVAAuAHcAZQBiA'\n            - 'TgBlAFQALgB3AGUAYg'\n            - 'OAGUAVAAuAHcAZQBiA'\n            - 'bgBFAFQALgB3AGUAYg'\n            - '4ARQBUAC4AdwBlAGIA'\n            - 'uAEUAVAAuAHcAZQBiA'\n            - 'bgBlAHQALgBXAGUAYg'\n            - '4AZQB0AC4AVwBlAGIA'\n            - 'uAGUAdAAuAFcAZQBiA'\n            - 'bgBFAHQALgBXAGUAYg'\n            - '4ARQB0AC4AVwBlAGIA'\n            - 'uAEUAdAAuAFcAZQBiA'\n            - 'TgBFAHQALgBXAGUAYg'\n            - 'OAEUAdAAuAFcAZQBiA'\n            - 'bgBlAFQALgBXAGUAYg'\n            - '4AZQBUAC4AVwBlAGIA'\n            - 'uAGUAVAAuAFcAZQBiA'\n            - 'TgBlAFQALgBXAGUAYg'\n            - 'OAGUAVAAuAFcAZQBiA'\n            - 'bgBFAFQALgBXAGUAYg'\n            - '4ARQBUAC4AVwBlAGIA'\n            - 'uAEUAVAAuAFcAZQBiA'\n            - 'bgBlAHQALgB3AEUAYg'\n            - '4AZQB0AC4AdwBFAGIA'\n            - 'uAGUAdAAuAHcARQBiA'\n            - 'TgBlAHQALgB3AEUAYg'\n            - 'OAGUAdAAuAHcARQBiA'\n            - 'bgBFAHQALgB3AEUAYg'\n            - '4ARQB0AC4AdwBFAGIA'\n            - 'uAEUAdAAuAHcARQBiA'\n            - 'TgBFAHQALgB3AEUAYg'\n            - 'OAEUAdAAuAHcARQBiA'\n            - 'bgBlAFQALgB3AEUAYg'\n            - '4AZQBUAC4AdwBFAGIA'\n            - 'uAGUAVAAuAHcARQBiA'\n            - 'TgBlAFQALgB3AEUAYg'\n            - 'OAGUAVAAuAHcARQBiA'\n            - 'bgBFAFQALgB3AEUAYg'\n            - '4ARQBUAC4AdwBFAGIA'\n            - 'uAEUAVAAuAHcARQBiA'\n            - 'TgBFAFQALgB3AEUAYg'\n            - 'OAEUAVAAuAHcARQBiA'\n            - 'bgBlAHQALgBXAEUAYg'\n            - '4AZQB0AC4AVwBFAGIA'\n            - 'uAGUAdAAuAFcARQBiA'\n            - 'TgBlAHQALgBXAEUAYg'\n            - 'OAGUAdAAuAFcARQBiA'\n            - 'bgBFAHQALgBXAEUAYg'\n            - '4ARQB0AC4AVwBFAGIA'\n            - 'uAEUAdAAuAFcARQBiA'\n            - 'TgBFAHQALgBXAEUAYg'\n            - 'OAEUAdAAuAFcARQBiA'\n            - 'bgBlAFQALgBXAEUAYg'\n            - '4AZQBUAC4AVwBFAGIA'\n            - 'uAGUAVAAuAFcARQBiA'\n            - 'TgBlAFQALgBXAEUAYg'\n            - 'OAGUAVAAuAFcARQBiA'\n            - 'bgBFAFQALgBXAEUAYg'\n            - '4ARQBUAC4AVwBFAGIA'\n            - 'uAEUAVAAuAFcARQBiA'\n            - 'TgBFAFQALgBXAEUAYg'\n            - 'OAEUAVAAuAFcARQBiA'\n            - 'bgBlAHQALgB3AGUAQg'\n            - '4AZQB0AC4AdwBlAEIA'\n            - 'uAGUAdAAuAHcAZQBCA'\n            - 'TgBlAHQALgB3AGUAQg'\n            - 'OAGUAdAAuAHcAZQBCA'\n            - 'bgBFAHQALgB3AGUAQg'\n            - '4ARQB0AC4AdwBlAEIA'\n            - 'uAEUAdAAuAHcAZQBCA'\n            - 'TgBFAHQALgB3AGUAQg'\n            - 'OAEUAdAAuAHcAZQBCA'\n            - 'bgBlAFQALgB3AGUAQg'\n            - '4AZQBUAC4AdwBlAEIA'\n            - 'uAGUAVAAuAHcAZQBCA'\n            - 'TgBlAFQALgB3AGUAQg'\n            - 'OAGUAVAAuAHcAZQBCA'\n            - 'bgBFAFQALgB3AGUAQg'\n            - '4ARQBUAC4AdwBlAEIA'\n            - 'uAEUAVAAuAHcAZQBCA'\n            - 'TgBFAFQALgB3AGUAQg'\n            - 'OAEUAVAAuAHcAZQBCA'\n            - 'bgBlAHQALgBXAGUAQg'\n            - '4AZQB0AC4AVwBlAEIA'\n            - 'uAGUAdAAuAFcAZQBCA'\n            - 'TgBlAHQALgBXAGUAQg'\n            - 'OAGUAdAAuAFcAZQBCA'\n            - 'bgBFAHQALgBXAGUAQg'\n            - '4ARQB0AC4AVwBlAEIA'\n            - 'uAEUAdAAuAFcAZQBCA'\n            - 'TgBFAHQALgBXAGUAQg'\n            - 'OAEUAdAAuAFcAZQBCA'\n            - 'bgBlAFQALgBXAGUAQg'\n            - '4AZQBUAC4AVwBlAEIA'\n            - 'uAGUAVAAuAFcAZQBCA'\n            - 'TgBlAFQALgBXAGUAQg'\n            - 'OAGUAVAAuAFcAZQBCA'\n            - 'bgBFAFQALgBXAGUAQg'\n            - '4ARQBUAC4AVwBlAEIA'\n            - 'uAEUAVAAuAFcAZQBCA'\n            - 'TgBFAFQALgBXAGUAQg'\n            - 'OAEUAVAAuAFcAZQBCA'\n            - 'bgBlAHQALgB3AEUAQg'\n            - '4AZQB0AC4AdwBFAEIA'\n            - 'uAGUAdAAuAHcARQBCA'\n            - 'TgBlAHQALgB3AEUAQg'\n            - 'OAGUAdAAuAHcARQBCA'\n            - 'bgBFAHQALgB3AEUAQg'\n            - '4ARQB0AC4AdwBFAEIA'\n            - 'uAEUAdAAuAHcARQBCA'\n            - 'TgBFAHQALgB3AEUAQg'\n            - 'OAEUAdAAuAHcARQBCA'\n            - 'bgBlAFQALgB3AEUAQg'\n            - 'uAGUAVAAuAHcARQBCA'\n            - 'bgBFAFQALgB3AEUAQg'\n            - '4ARQBUAC4AdwBFAEIA'\n            - 'uAEUAVAAuAHcARQBCA'\n            - 'TgBFAFQALgB3AEUAQg'\n            - 'OAEUAVAAuAHcARQBCA'\n            - 'TgBlAHQALgBXAEUAQg'\n            - '4AZQB0AC4AVwBFAEIA'\n            - 'OAGUAdAAuAFcARQBCA'\n            - 'bgBFAHQALgBXAEUAQg'\n            - '4ARQB0AC4AVwBFAEIA'\n            - 'uAEUAdAAuAFcARQBCA'\n            - 'TgBFAHQALgBXAEUAQg'\n            - 'OAEUAdAAuAFcARQBCA'\n            - 'bgBlAFQALgBXAEUAQg'\n            - '4AZQBUAC4AVwBFAEIA'\n            - 'uAGUAVAAuAFcARQBCA'\n            - 'TgBlAFQALgBXAEUAQg'\n            - 'OAGUAVAAuAFcARQBCA'\n            - 'bgBFAFQALgBXAEUAQg'\n            - '4ARQBUAC4AVwBFAEIA'\n            - 'uAEUAVAAuAFcARQBCA'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/c86133ad-4725-4bd0-8170-210788e0a7ba.json","kind":"sigma"}