huntrule

Suspicious PowerShell Start-Job with Base64 Scriptblock (via ps_script)

PremiumReviewedSigma · Medium · v1
Product
windows
Category
ps_script
Author
HuntRule
Published
2026-05-10
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects the GootBot implant using the PowerShell Start-Job cmdlet to run base64-decoded payloads in background jobs, evading child-process monitoring. The pairing of Start-Job with a FromBase64String call inside a scriptblock is a strong indicator of in-memory loader activity. Routine administrative scripts seldom combine these.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious node.exe Execution Spawned by PowerShell
Suspicious PowerShell Spawned by mshta.exe in FakeSG Chain (via process_creation)
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Malicious IIS Worker Process Spawning Command Shell for Webshell Reconnaissance (via process_creation)
Suspicious PowerShell Spawned by Windows Script Host during Scarlet Goldfinch Infection (via process_creation)
Suspicious PowerShell Launched by MSIX StartingScriptWrapper From WindowsApps via Process Creation (via process_creation)
Malicious Command Shell or PowerShell Spawned by Tomcat via Process Creation (via process_creation)
Suspicious PowerShell Download Cradle via IEX and DownloadString (via process_creation)
Suspicious Hidden PowerShell Spawned by MSHTA for Boot Persistence (via process_creation)
Suspicious PowerShell Start-Job with Base64 Scriptblock (via ps_script)
Pivot detection · T1059.001 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.