PowerShell FromBase64String Decoding of Base64 Gzip Content in Process Creation on Windows

Windows process command lines using PowerShell FromBase64String with MemoryStream and Gzip-like Base64 markers (H4sI) are flagged.

FreeUnreviewedSigmamediumv1

powershell-frombase64string-decoding-of-base64-gzip-content-in-process-creation--d75d6b6b

title: PowerShell FromBase64String Decoding of Base64 Gzip Content in Process Creation on Windows
id: 62acfbdd-1c1e-4f84-89ee-6bf9177ada6d
related:
  - id: df69cb1d-b891-4cd9-90c7-d617d90100ce
    type: similar
  - id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
    type: derived
status: test
description: This rule flags Windows process creation events where the command line contains PowerShell decoding of a Base64 payload using FromBase64String, combined with evidence of in-memory handling (MemoryStream) and a Gzip header marker (H4sI). Attackers commonly use this pattern to reconstruct compressed data and prepare it for execution or loading into memory without writing cleartext artifacts to disk. Detection relies on process command-line telemetry capturing these specific substrings within the PowerShell command line.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_frombase64string_archive.yml
author: frack113, Huntrule Team
date: 2022-12-23
tags:
  - attack.command-and-control
  - attack.t1132.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - FromBase64String
      - MemoryStream
      - H4sI
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the command line contains PowerShell decoding of a Base64 payload using FromBase64String, combined with evidence of in-memory handling (MemoryStream) and a Gzip header marker (H4sI). Attackers commonly use this pattern to reconstruct compressed data and prepare it for execution or loading into memory without writing cleartext artifacts to disk. Detection relies on process command-line telemetry capturing these specific substrings within the PowerShell command line.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.