PowerShell GzipStream Decompression Attempts on Windows
Detects Windows PowerShell commands using GZipStream and ::Decompress to decompress encoded Gzip data.
- Product
- windows
- Category
- process_creation
- Author
- Hieu Tran (SigmaHQ), DRL 1.1
- Published
- 2023-03-13
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags PowerShell process executions whose command line includes both the GZipStream class and the ::Decompress method, indicating attempts to decode or decompress data using Gzip. Attackers commonly use in-memory or scripted decompression to unpack payloads or transform encoded content before further execution. Detection relies on Windows process creation telemetry and the exact presence of these PowerShell/decompression tokens in the command line.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: PowerShell GzipStream Decompression Attempts on Windows
id: 756a789e-4511-48bf-9a9f-6c8b8915cfec
status: test
description: This rule flags PowerShell process executions whose command line includes both the GZipStream class and the ::Decompress method, indicating attempts to decode or decompress data using Gzip. Attackers commonly use in-memory or scripted decompression to unpack payloads or transform encoded content before further execution. Detection relies on Windows process creation telemetry and the exact presence of these PowerShell/decompression tokens in the command line.
references:
- https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_decode_gzip.yml
author: Hieu Tran, Huntrule Team
date: 2023-03-13
tags:
- attack.command-and-control
- attack.t1132.001
logsource:
product: windows
category: process_creation
detection:
selection:
CommandLine|contains|all:
- GZipStream
- ::Decompress
condition: selection
falsepositives:
- Legitimate administrative scripts may use this functionality. Use "ParentImage" in combination with the script names and allowed users and applications to filter legitimate executions
level: medium
license: DRL-1.1
related:
- id: 98767d61-b2e8-4d71-b661-e36783ee24c1
type: derived