PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)

Detects PowerShell process creation where the command line includes ::FromBase64String(, indicating Base64 decoding.

FreeUnreviewedSigmahighv1

powershell-commandline-uses-frombase64string-to-decode-base64-content-windows-e32d4572

title: PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)
id: ac7e8146-9e1a-4fef-8e2b-a726b1b5cef7
status: test
description: This rule flags Windows process creation events where the PowerShell command line contains the PowerShell method call "::FromBase64String(". Attackers often use Base64 encoding to hide or obfuscate script content passed to PowerShell, which can help evade casual inspection and some defenses. The detection relies on command-line text captured in process creation telemetry.
references:
  - https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2020-01-29
modified: 2023-01-26
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1140
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains: ::FromBase64String(
  condition: selection
falsepositives:
  - Administrative script libraries
level: high
license: DRL-1.1
related:
  - id: e32d4572-9826-4738-b651-95fa63747e8a
    type: derived

What it detects

This rule flags Windows process creation events where the PowerShell command line contains the PowerShell method call "::FromBase64String(". Attackers often use Base64 encoding to hide or obfuscate script content passed to PowerShell, which can help evade casual inspection and some defenses. The detection relies on command-line text captured in process creation telemetry.

Known false positives

Administrative script libraries

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.