PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)

Flags PowerShell command lines containing FromBase64String along with base64-encoded UTF-16 marker patterns.

FreeReviewedSigma · High · v1

Product: windows
Category: process_creation
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2019-08-24
Updated: 2026-07-30

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
- T1140Deobfuscate/Decode Files or Information
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows process creation events where the command line includes the PowerShell base64 decoding pattern referencing FromBase64String. Attackers use FromBase64String to obfuscate commands and payloads, making content less readable in logs and aiding stealth. The detection relies on process command-line telemetry matching the FromBase64String marker and specific base64-encoded UTF-16 LE substrings.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange

Hidden PowerShell Archive Extraction via ExtractToDirectory

CastleLoader ClickFix PowerShell Hex Decode and Re-Execution

PowerShell Base64 Download Cradle via FromBase64String and Invoke-Expression (via ps_script)

Windows Process Command-Line Indicators of BlackByte Ransomware Activity

PowerShell CommandLine Uses FromBase64String to Decode Base64 Content (Windows)

Suspicious XOR-Encoded PowerShell Command Line (Windows Process Creation)

Suspicious Script Host Spawning Hidden PowerShell (via process_creation)

Suspicious PowerShell Reflective Assembly Load With GZip Decompression (via process_creation)

Suspicious PowerShell Invoke-Expression with Replace Obfuscation

PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)

Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-frombase64string-commandline-base64-encoded-usage-windows-fdb62a13

title: PowerShell FromBase64String CommandLine Base64 Encoded Usage (Windows)
id: 18bf259c-4a79-4a23-9411-0168f35c1b10
status: test
description: This rule identifies Windows process creation events where the command line includes the PowerShell base64 decoding pattern referencing FromBase64String. Attackers use FromBase64String to obfuscate commands and payloads, making content less readable in logs and aiding stealth. The detection relies on process command-line telemetry matching the FromBase64String marker and specific base64-encoded UTF-16 LE substrings.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-08-24
modified: 2023-04-06
tags:
  - attack.stealth
  - attack.t1140
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|base64offset|contains: ::FromBase64String
    - CommandLine|contains:
        - OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA
        - oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA
        - 6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL