PowerShell script block obfuscation via STDIN execution patterns

Detects PowerShell script blocks that use obfuscated STDIN-driven cmd/powershell execution patterns.

FreeUnreviewedSigmahighv1

powershell-script-block-obfuscation-via-stdin-execution-patterns-779c8c12

title: PowerShell script block obfuscation via STDIN execution patterns
id: d8e8f341-b49c-4711-9f76-a47cea95b3f9
status: test
description: This rule flags PowerShell activity where script block content matches an obfuscated invocation pattern using standard input and includes cmd.exe execution parameters followed by PowerShell and input handling (e.g., {input} or noexit). Attackers commonly use STDIN and obfuscation to reduce visibility and complicate analysis while still executing PowerShell payloads. The detection relies on PowerShell Script Block Logging telemetry that records ScriptBlockText content for pattern matching.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|re: cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+"
  condition: selection_4104
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 779c8c12-0eb1-11eb-adc1-0242ac120002
    type: derived

What it detects

This rule flags PowerShell activity where script block content matches an obfuscated invocation pattern using standard input and includes cmd.exe execution parameters followed by PowerShell and input handling (e.g., {input} or noexit). Attackers commonly use STDIN and obfuscation to reduce visibility and complicate analysis while still executing PowerShell payloads. The detection relies on PowerShell Script Block Logging telemetry that records ScriptBlockText content for pattern matching.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.