PowerShell GzipStream Decompression Attempts on Windows

Detects Windows PowerShell commands using GZipStream and ::Decompress to decompress encoded Gzip data.

FreeUnreviewedSigmamediumv1

powershell-gzipstream-decompression-attempts-on-windows-98767d61

title: PowerShell GzipStream Decompression Attempts on Windows
id: 756a789e-4511-48bf-9a9f-6c8b8915cfec
status: test
description: This rule flags PowerShell process executions whose command line includes both the GZipStream class and the ::Decompress method, indicating attempts to decode or decompress data using Gzip. Attackers commonly use in-memory or scripted decompression to unpack payloads or transform encoded content before further execution. Detection relies on Windows process creation telemetry and the exact presence of these PowerShell/decompression tokens in the command line.
references:
  - https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml
author: Hieu Tran, Huntrule Team
date: 2023-03-13
tags:
  - attack.command-and-control
  - attack.t1132.001
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:
      - GZipStream
      - ::Decompress
  condition: selection
falsepositives:
  - Legitimate administrative scripts may use this functionality. Use "ParentImage" in combination with the script names and allowed users and applications to filter legitimate executions
level: medium
license: DRL-1.1
related:
  - id: 98767d61-b2e8-4d71-b661-e36783ee24c1
    type: derived

What it detects

This rule flags PowerShell process executions whose command line includes both the GZipStream class and the ::Decompress method, indicating attempts to decode or decompress data using Gzip. Attackers commonly use in-memory or scripted decompression to unpack payloads or transform encoded content before further execution. Detection relies on Windows process creation telemetry and the exact presence of these PowerShell/decompression tokens in the command line.

Known false positives

Legitimate administrative scripts may use this functionality. Use "ParentImage" in combination with the script names and allowed users and applications to filter legitimate executions

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.