PowerShell Data Exfiltration Using Audio File (WAV BinaryWriter) on Windows
Alerts on PowerShell script blocks that appear to write data into an audio (WAV) file for potential exfiltration.
FreeReviewedSigma · Medium · v2
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-16
- Updated
- 2026-07-31
What it detects
This rule identifies PowerShell script content that assembles audio/WAV-like binary output using BinaryWriter and file mode operations, along with byte patterns consistent with a WAV header. Attackers can use this technique to conceal exfiltrated data inside media-like files to evade straightforward network or content inspection. It relies on Script Block Logging telemetry capturing the PowerShell ScriptBlockText that matches the specified .NET and header byte strings.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
potential-data-exfiltration-via-audio-file-using-powershell-script-block-e4f93c99
title: PowerShell Data Exfiltration Using Audio File (WAV BinaryWriter) on Windows
id: cedb117c-a3ea-4da6-9066-fc9355e9fd09
status: test
description: This rule identifies PowerShell script content that assembles audio/WAV-like binary output using BinaryWriter and file mode operations, along with byte patterns consistent with a WAV header. Attackers can use this technique to conceal exfiltrated data inside media-like files to evade straightforward network or content inspection. It relies on Script Block Logging telemetry capturing the PowerShell ScriptBlockText that matches the specified .NET and header byte strings.
references:
- https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_audio_exfiltration.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-16
tags:
- attack.exfiltration
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection_main:
ScriptBlockText|contains|all:
- "[System.Math]::"
- "[IO.FileMode]::"
- BinaryWriter
selection_header_wav:
ScriptBlockText|contains|all:
- "0x52"
- "0x49"
- "0x46"
- "0x57"
- "0x41"
- "0x56"
- "0x45"
- "0xAC"
condition: selection_main and 1 of selection_header_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: e4f93c99-396f-47c8-bb0f-201b1fa69034
type: derived