PowerShell FromBase64String Decoding of Base64 Gzip Content in Process Creation on Windows
Windows process command lines using PowerShell FromBase64String with MemoryStream and Gzip-like Base64 markers (H4sI) are flagged.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-12-23
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line contains PowerShell decoding of a Base64 payload using FromBase64String, combined with evidence of in-memory handling (MemoryStream) and a Gzip header marker (H4sI). Attackers commonly use this pattern to reconstruct compressed data and prepare it for execution or loading into memory without writing cleartext artifacts to disk. Detection relies on process command-line telemetry capturing these specific substrings within the PowerShell command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell FromBase64String Decoding of Base64 Gzip Content in Process Creation on Windows
id: 62acfbdd-1c1e-4f84-89ee-6bf9177ada6d
related:
- id: df69cb1d-b891-4cd9-90c7-d617d90100ce
type: similar
- id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
type: derived
status: test
description: This rule flags Windows process creation events where the command line contains PowerShell decoding of a Base64 payload using FromBase64String, combined with evidence of in-memory handling (MemoryStream) and a Gzip header marker (H4sI). Attackers commonly use this pattern to reconstruct compressed data and prepare it for execution or loading into memory without writing cleartext artifacts to disk. Detection relies on process command-line telemetry capturing these specific substrings within the PowerShell command line.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml
author: frack113, Huntrule Team
date: 2022-12-23
tags:
- attack.command-and-control
- attack.t1132.001
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains|all:
- FromBase64String
- MemoryStream
- H4sI
condition: selection
falsepositives:
- Legitimate administrative script
level: medium
license: DRL-1.1