Possible Data Exfiltration Through Audio File (via ps_script)

title: Possible Data Exfiltration Through Audio File (via ps_script)
id: 54fae0f2-5876-592f-ac21-1191ddc2a998
status: stable
description: This rule detects potential exfiltration attempt via audio file using PowerShell
references:
    - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1
author: Huntrule Team
date: 2026-04-09
tags:
    - attack.exfiltration
    - attack.defense-evasion
    - attack.t1027
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection_main:
        ScriptBlockText|contains|all:
            - '[System.Math]::'
            - '[IO.FileMode]::'
            - 'BinaryWriter'
    selection_header_wav:
        ScriptBlockText|contains|all:
            - '0x52'
            - '0x49'
            - '0x46'
            - '0x57'
            - '0x41'
            - '0x56'
            - '0x45'
            - '0xAC'
    condition: selection_main and 1 of selection_header_*
falsepositives:
    - Unknown
level: medium