{"id":"cdf05894-89e7-4ead-b2b0-0a5f97a90f2f","title":"Potential Encoded PowerShell Patterns In CommandLine","description":"Detects specific combinations of encoding methods in PowerShell via the commandline","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","status":"test","level":"low","date":"2020-10-11","modified":"2023-01-26","tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"technique_ids":["T1027","T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml","source_sha256":"4f0ec8ff7fa1ecbc8f6d0988afb9c9dce97512381e8f7de77ec821903ac8ef66","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Encoded PowerShell Patterns In CommandLine\nid: cdf05894-89e7-4ead-b2b0-0a5f97a90f2f\nrelated:\n    - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6\n      type: similar\nstatus: test\ndescription: Detects specific combinations of encoding methods in PowerShell via the commandline\nreferences:\n    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65\nauthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton\ndate: 2020-10-11\nmodified: 2023-01-26\ntags:\n    - attack.stealth\n    - attack.t1027\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_to_1:\n        CommandLine|contains:\n            - 'ToInt'\n            - 'ToDecimal'\n            - 'ToByte'\n            - 'ToUint'\n            - 'ToSingle'\n            - 'ToSByte'\n    selection_to_2:\n        CommandLine|contains:\n            - 'ToChar'\n            - 'ToString'\n            - 'String'\n    selection_gen_1:\n        CommandLine|contains|all:\n            - 'char'\n            - 'join'\n    selection_gen_2:\n        CommandLine|contains|all:\n            - 'split'\n            - 'join'\n    condition: selection_img and (all of selection_to_* or 1 of selection_gen_*)\nfalsepositives:\n    - Unknown\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1027","id":"T1027","name":"Obfuscated Files or Information","page":"techniques/enterprise/T1027/"},{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/cdf05894-89e7-4ead-b2b0-0a5f97a90f2f.json","kind":"sigma"}