PowerShell command-line obfuscation indicators from special-character patterns (Windows)

title: PowerShell command-line obfuscation indicators from special-character patterns (Windows)
id: 44ceb30f-ff2d-403e-b911-4d05292dbbd3
status: test
description: This rule flags Windows process creations where the executed binary is PowerShell (powershell.exe/pwsh.exe) and the command line contains repeated special-character patterns consistent with obfuscation. Attackers often use such formatting to hinder parsing and analysis while still running the same scripts. It relies on process creation telemetry, matching the command line against multiple regular-expression indicators and using image/path and optional allowlists to reduce known benign activity.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=64
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml
author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp), Huntrule Team
date: 2020-10-15
modified: 2024-04-15
tags:
  - attack.execution
  - attack.stealth
  - attack.t1027
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_re:
    - CommandLine|re: \+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+.*\+
    - CommandLine|re: \{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{.*\{
    - CommandLine|re: \^.*\^.*\^.*\^.*\^
    - CommandLine|re: "`.*`.*`.*`.*`"
  filter_optional_amazonSSM:
    ParentImage: C:\Program Files\Amazon\SSM\ssm-document-worker.exe
  filter_optional_defender_atp:
    CommandLine|contains:
      - new EventSource("Microsoft.Windows.Sense.Client.Management"
      - public static extern bool InstallELAMCertificateInfo(SafeFileHandle handle);
  condition: all of selection_* and not 1 of filter_optional_*
falsepositives:
  - Amazon SSM Document Worker
  - Windows Defender ATP
level: high
license: DRL-1.1
related:
  - id: d7bcd677-645d-4691-a8d4-7a5602b780d1
    type: derived