{"id":"f26c6093-6f14-4b12-800f-0fcb46f5ffd0","title":"Malicious Base64 Encoded PowerShell Keywords in Command Lines","description":"Detects base64 encoded strings used in hidden malicious PowerShell command lines","author":"John Lambert (rule)","status":"test","level":"high","date":"2019-01-16","modified":"2023-01-05","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Unknown"],"references":["http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/"],"source_path":"rules/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml","source_sha256":"b4d024a513d7af863cdad4bdabe0855005de1a1a8cc5cdd41e134a71f0ee7f8d","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Malicious Base64 Encoded PowerShell Keywords in Command Lines\nid: f26c6093-6f14-4b12-800f-0fcb46f5ffd0\nstatus: test\ndescription: Detects base64 encoded strings used in hidden malicious PowerShell command lines\nreferences:\n    - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/\nauthor: John Lambert (rule)\ndate: 2019-01-16\nmodified: 2023-01-05\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\powershell.exe'\n              - '\\pwsh.exe'\n        - OriginalFileName:\n              - 'PowerShell.EXE'\n              - 'pwsh.dll'\n    selection_hidden:\n        CommandLine|contains: ' hidden '\n    selection_encoded:\n        CommandLine|contains:\n            - 'AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA'\n            - 'aXRzYWRtaW4gL3RyYW5zZmVy'\n            - 'IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA'\n            - 'JpdHNhZG1pbiAvdHJhbnNmZX'\n            - 'YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg'\n            - 'Yml0c2FkbWluIC90cmFuc2Zlc'\n            - 'AGMAaAB1AG4AawBfAHMAaQB6AGUA'\n            - 'JABjAGgAdQBuAGsAXwBzAGkAegBlA'\n            - 'JGNodW5rX3Npem'\n            - 'QAYwBoAHUAbgBrAF8AcwBpAHoAZQ'\n            - 'RjaHVua19zaXpl'\n            - 'Y2h1bmtfc2l6Z'\n            - 'AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A'\n            - 'kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg'\n            - 'lPLkNvbXByZXNzaW9u'\n            - 'SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA'\n            - 'SU8uQ29tcHJlc3Npb2'\n            - 'Ty5Db21wcmVzc2lvb'\n            - 'AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ'\n            - 'kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA'\n            - 'lPLk1lbW9yeVN0cmVhb'\n            - 'SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A'\n            - 'SU8uTWVtb3J5U3RyZWFt'\n            - 'Ty5NZW1vcnlTdHJlYW'\n            - '4ARwBlAHQAQwBoAHUAbgBrA'\n            - '5HZXRDaHVua'\n            - 'AEcAZQB0AEMAaAB1AG4Aaw'\n            - 'LgBHAGUAdABDAGgAdQBuAGsA'\n            - 'LkdldENodW5r'\n            - 'R2V0Q2h1bm'\n            - 'AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A'\n            - 'QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA'\n            - 'RIUkVBRF9JTkZPNj'\n            - 'SFJFQURfSU5GTzY0'\n            - 'VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA'\n            - 'VEhSRUFEX0lORk82N'\n            - 'AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA'\n            - 'cmVhdGVSZW1vdGVUaHJlYW'\n            - 'MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA'\n            - 'NyZWF0ZVJlbW90ZVRocmVhZ'\n            - 'Q3JlYXRlUmVtb3RlVGhyZWFk'\n            - 'QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA'\n            - '0AZQBtAG0AbwB2AGUA'\n            - '1lbW1vdm'\n            - 'AGUAbQBtAG8AdgBlA'\n            - 'bQBlAG0AbQBvAHYAZQ'\n            - 'bWVtbW92Z'\n            - 'ZW1tb3Zl'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/f26c6093-6f14-4b12-800f-0fcb46f5ffd0.json","kind":"sigma"}