PowerShell Module Payload with COMPRESS OBFUSCATION and ASCII Encoding

Identifies PowerShell module payloads containing ASCII encoding and compression/stream obfuscation strings.

FreeUnreviewedSigmamediumv1

powershell-module-payload-with-compress-obfuscation-and-ascii-encoding-7034cbbb

title: PowerShell Module Payload with COMPRESS OBFUSCATION and ASCII Encoding
id: 7b68704f-2484-45ea-92a9-10932bcc27af
related:
  - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07
    type: derived
  - id: 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1
    type: derived
status: test
description: This rule flags PowerShell module content where the payload includes both an obfuscation pattern using new-object with [text.encoding]::ascii and related compression/stream-reading strings. Attackers may use these constructs to disguise script logic and evade straightforward inspection. The detection relies on module payload telemetry that captures the raw Payload text and supports substring and suffix matching.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|contains|all:
      - new-object
      - text.encoding]::ascii
    Payload|contains:
      - system.io.compression.deflatestream
      - system.io.streamreader
    Payload|endswith: readtoend
  condition: selection_4103
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell module content where the payload includes both an obfuscation pattern using new-object with [text.encoding]::ascii and related compression/stream-reading strings. Attackers may use these constructs to disguise script logic and evade straightforward inspection. The detection relies on module payload telemetry that captures the raw Payload text and supports substring and suffix matching.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.