huntrule

Potential Data Exfiltration via Audio File Using PowerShell Script Block

Alerts on PowerShell script blocks that appear to write data into an audio (WAV) file for potential exfiltration.

FreeUnreviewedSigmamediumv1
title: Potential Data Exfiltration via Audio File Using PowerShell Script Block
id: cedb117c-a3ea-4da6-9066-fc9355e9fd09
status: test
description: This rule flags PowerShell script block content consistent with writing data to an audio (WAV) file by combining binary file writes with math-based processing. Attackers may use audio as a covert container to move data while blending in with seemingly benign file activity. It relies on Script Block Logging telemetry, specifically the presence of .NET file/binary writing constructs and recognizable WAV header byte patterns embedded in the script.
references:
  - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_audio_exfiltration.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
  - attack.exfiltration
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_main:
    ScriptBlockText|contains|all:
      - "[System.Math]::"
      - "[IO.FileMode]::"
      - BinaryWriter
  selection_header_wav:
    ScriptBlockText|contains|all:
      - "0x52"
      - "0x49"
      - "0x46"
      - "0x57"
      - "0x41"
      - "0x56"
      - "0x45"
      - "0xAC"
  condition: selection_main and 1 of selection_header_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: e4f93c99-396f-47c8-bb0f-201b1fa69034
    type: derived

What it detects

This rule flags PowerShell script block content consistent with writing data to an audio (WAV) file by combining binary file writes with math-based processing. Attackers may use audio as a covert container to move data while blending in with seemingly benign file activity. It relies on Script Block Logging telemetry, specifically the presence of .NET file/binary writing constructs and recognizable WAV header byte patterns embedded in the script.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.