PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)

Flags PowerShell command lines containing FromBase64String along with base64-encoded UTF-16 marker patterns.

FreeUnreviewedSigmahighv1

powershell-frombase64string-commandline-base64-encoded-usage-windows-fdb62a13

title: PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)
id: 18bf259c-4a79-4a23-9411-0168f35c1b10
status: test
description: This rule identifies Windows process creation events where the command line includes the PowerShell base64 decoding pattern referencing FromBase64String. Attackers use FromBase64String to obfuscate commands and payloads, making content less readable in logs and aiding stealth. The detection relies on process command-line telemetry matching the FromBase64String marker and specific base64-encoded UTF-16 LE substrings.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-08-24
modified: 2023-04-06
tags:
  - attack.stealth
  - attack.t1140
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|base64offset|contains: ::FromBase64String
    - CommandLine|contains:
        - OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA
        - oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA
        - 6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
    type: derived

What it detects

This rule identifies Windows process creation events where the command line includes the PowerShell base64 decoding pattern referencing FromBase64String. Attackers use FromBase64String to obfuscate commands and payloads, making content less readable in logs and aiding stealth. The detection relies on process command-line telemetry matching the FromBase64String marker and specific base64-encoded UTF-16 LE substrings.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.