PowerShell Stdin Obfuscation Execution from Command Line

Flags PowerShell-like command-line patterns indicating obfuscated execution using stdin or input substitution.

FreeUnreviewedSigmahighv1

powershell-stdin-obfuscation-execution-from-command-line-9c14c9fa

title: PowerShell Stdin Obfuscation Execution from Command Line
id: 929d2e2b-2f52-49cc-ba21-bc2426bd4a6b
status: test
description: This rule flags Windows process creation events where a command line appears to use obfuscation patterns involving environment/input substitution and PowerShell execution chained with set operations. Attackers commonly use chained command-line constructs and stdin/input-driven execution to conceal malicious activity and evade simple string-based detections. The detection relies on process creation telemetry, matching the command line against a case-insensitive regular expression for the observed chaining and input/environment usage.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml
author: Nikita Nazarov, oscd.community, Huntrule Team
date: 2020-10-12
modified: 2026-03-16
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|re: (?i)(?:set).*&&\s?set.*(?:environment|invoke|\$\{?input).*&&.*"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 9c14c9fa-1a63-4a64-8e57-d19280559490
    type: derived

What it detects

This rule flags Windows process creation events where a command line appears to use obfuscation patterns involving environment/input substitution and PowerShell execution chained with set operations. Attackers commonly use chained command-line constructs and stdin/input-driven execution to conceal malicious activity and evade simple string-based detections. The detection relies on process creation telemetry, matching the command line against a case-insensitive regular expression for the observed chaining and input/environment usage.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.