PowerShell Classic bXOR Operator Usage in Command Line
Identifies PowerShell classic executions from ConsoleHost using the -bxor operator in the command line.
- Product
- windows
- Category
- ps_classic_start
- Author
- Teymur Kheirkhabarov, Harish Segar (SigmaHQ), DRL 1.1
- Published
- 2020-06-29
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell Classic command lines executed via ConsoleHost that include the substring " -bxor ", indicating use of the bitwise XOR operator. Attackers may use XOR to obfuscate or transform payloads to reduce the visibility of malicious content. It relies on Windows PowerShell Classic process start telemetry with access to the full CommandLine value and the HostName field to confirm the execution context.
Reporting behind it
- speakerdeck.comhttps://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=46
- learn.microsoft.comhttps://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_bxor_operator_usage.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell Classic bXOR Operator Usage in Command Line
id: 62691060-8e8d-4336-a7f6-6df32c3a0c24
status: test
description: This rule flags PowerShell Classic command lines executed via ConsoleHost that include the substring " -bxor ", indicating use of the bitwise XOR operator. Attackers may use XOR to obfuscate or transform payloads to reduce the visibility of malicious content. It relies on Windows PowerShell Classic process start telemetry with access to the full CommandLine value and the HostName field to confirm the execution context.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=46
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
- https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_bxor_operator_usage.yml
author: Teymur Kheirkhabarov, Harish Segar, Huntrule Team
date: 2020-06-29
modified: 2024-12-11
tags:
- attack.execution
- attack.t1059.001
- detection.threat-hunting
logsource:
product: windows
category: ps_classic_start
detection:
selection:
Data|contains|all:
- HostName=ConsoleHost
- " -bxor "
condition: selection
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
type: derived