PowerShell Classic: Detect bxor Operator in ConsoleHost Command Line

title: "PowerShell Classic: Detect bxor Operator in ConsoleHost Command Line"
id: 62691060-8e8d-4336-a7f6-6df32c3a0c24
status: test
description: This rule flags PowerShell classic process executions whose command line includes the bitwise XOR operator token (" -bxor ") when running under ConsoleHost. Attackers can use bxor as an alternative to more common obfuscation techniques to hinder analysis of PowerShell activity. Investigate the CommandLine content and related process tree context to determine whether the use of bxor is legitimate or part of malicious command construction.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=46
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_bxor_operator_usage.yml
author: Teymur Kheirkhabarov, Harish Segar, Huntrule Team
date: 2020-06-29
modified: 2024-12-11
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection:
    Data|contains|all:
      - HostName=ConsoleHost
      - " -bxor "
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
    type: derived