PowerShell Obfuscation Using COMPRESS/Compression Streams

Flags PowerShell script blocks that combine ASCII encoding with Deflate/stream handling indicative of obfuscated payload compression.

FreeUnreviewedSigmamediumv1

powershell-obfuscation-using-compress-compression-streams-20e5497e

title: PowerShell Obfuscation Using COMPRESS/Compression Streams
id: bf220408-131c-487a-9d58-1b607223f845
status: test
description: "This rule identifies PowerShell script blocks that include elements commonly used in obfuscation routines: creating objects, using ASCII text encoding, and interacting with .NET compression streams such as DeflateStream and StreamReader. Attackers may use these patterns to compress and encode payload content to reduce readability and hinder analysis. The detection relies on Windows PowerShell Script Block Logging telemetry by matching specific string patterns within ScriptBlockText."
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|contains|all:
      - new-object
      - text.encoding]::ascii
    ScriptBlockText|contains:
      - system.io.compression.deflatestream
      - system.io.streamreader
    ScriptBlockText|endswith: readtoend
  condition: selection_4104
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07
    type: derived

What it detects

This rule identifies PowerShell script blocks that include elements commonly used in obfuscation routines: creating objects, using ASCII text encoding, and interacting with .NET compression streams such as DeflateStream and StreamReader. Attackers may use these patterns to compress and encode payload content to reduce readability and hinder analysis. The detection relies on Windows PowerShell Script Block Logging telemetry by matching specific string patterns within ScriptBlockText.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.