PowerShell Obfuscation via Stdin Using Service Parameter Strings (Windows Security 4697)

title: PowerShell Obfuscation via Stdin Using Service Parameter Strings (Windows Security 4697)
id: b6273dd9-0629-400a-9b5c-c9244d90212d
related:
  - id: 487c7524-f892-4054-b263-8a0ace63fc25
    type: derived
  - id: 80b708f3-d034-40e4-a6c8-d23b7a7db3d1
    type: derived
status: test
description: This rule flags Windows Security audit events (EventID 4697) where the configured service command line contains multiple PowerShell-related obfuscation indicators, including the text "set", logical operator "&&", and substrings consistent with environment/input-driven invocation. Attackers may use stdin-based or input-fed command construction to hide malicious logic and make PowerShell execution harder to interpret during investigations. Detection relies on Security log EventID 4697 and pattern matching against the ServiceFileName field contents.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains|all:
      - set
      - "&&"
    ServiceFileName|contains:
      - environment
      - invoke
      - ${input)
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1