PowerShell VAR+ Obfuscation via cmd /c or /r and set with {#} expansion

title: PowerShell VAR+ Obfuscation via cmd /c or /r and set with {#} expansion
id: ab42c64b-bc91-4148-988d-1a7d65ca0cbf
status: test
description: This rule flags PowerShell script block content that invokes cmd.exe with /c or /r and uses an obfuscation pattern based on a set operation and numbered brace expansion (e.g., {1} style placeholders). Attackers use this kind of variable expansion to disguise execution flow and reduce the visibility of the final command. The detection relies on Script Block Logging telemetry by matching the script block text against a regular expression for these specific cmd/set expansion patterns.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_4104:
    ScriptBlockText|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*"
  condition: selection_4104
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 0adfbc14-0ed1-11eb-adc1-0242ac120002
    type: derived