huntrule

Suspicious Base64 Encoded PowerShell Command Linked to Chinese APT Techniques

PremiumReviewedSigma · Medium · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-10-03
Updated
2026-10-03
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell launched with an encoded command argument, an obfuscation technique used in trending Chinese APT operations to hide malicious script content. Attackers pass Base64-encoded commands to evade command-line inspection, so encoded PowerShell invocations are a common defense-evasion behavior that benefits from execution review.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious Scheduled Task Creation in Public Writable Directory via schtasks (via process_creation)
Suspicious Scheduled Task Executing Payload from AppData
Malicious PowerShell Runtime Loaded Outside PowerShell Host
Suspicious PowerShell Harvesting RDP Logon Events via Get-WinEvent
Suspicious PowerShell Web Request to oastify Out-of-Band Domain
Suspicious PowerShell Execution of Untitled1 Script From ProgramData
Suspicious PowerShell Spawned by Komari Monitoring Agent
Suspicious Node Package Install Spawning Script Interpreters via process_creation
Suspicious PowerShell Spawned by ScreenConnect Remote Access Client
Suspicious Base64 Encoded PowerShell Command Linked to Chinese APT Techniques
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.