PowerShell Module: Obfuscated stdin-based launcher execution

title: "PowerShell Module: Obfuscated stdin-based launcher execution"
id: 1852384a-6cbb-4a77-895a-ebdf4b5c4eff
related:
  - id: 779c8c12-0eb1-11eb-adc1-0242ac120002
    type: derived
  - id: 9ac8b09b-45de-4a07-9da1-0de8c09304a3
    type: derived
status: test
description: This rule flags PowerShell module activity where the command line payload contains an obfuscated pattern invoking cmd with /c or /r and subsequently launching PowerShell. It specifically looks for use of stdin via input placeholders (e.g., ${input} or input) and execution flags like noexit, which are commonly used to hide the true command source. Telemetry relies on Windows PowerShell module command-line payload content matching the specified regular expression.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+"
  condition: selection_4103
falsepositives:
  - Unknown
level: high
license: DRL-1.1