huntrule

Suspicious PowerShell With Reversed HTTP String (via process_creation)

PremiumReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
HuntRule
Published
2026-07-31
Updated
2026-08-28
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects PowerShell command lines containing the reversed HTTP string used to hide C2 URLs. This steganography spam campaign reverses download URLs before reconstructing them at runtime.

Reporting behind it

Related detections9 linkedT1027 — drag to rearrange
Suspicious Archive Extraction From AppData Staging Folder via Process Creation
Suspicious Encoded PowerShell Using Base64 Stream Decompression Routines (via process_creation)
Suspicious PowerShell In-Memory Execution with AES Decryption
Suspicious Encoded PowerShell Command Execution
Suspicious node.exe Executing Compiled JavaScript Bytecode File
Malicious Encoded Payload Decoded and Piped to Shell via xxd or base64 (via process_creation)
Suspicious PEAKLIGHT Memory-Only PowerShell Downloader Flags (via process_creation)
Suspicious Fake GIF Magic Header Written to Disguise Payload File (via process_creation)
Suspicious Base64 Decode Piped to Python Interpreter for In-Memory Execution (via process_creation)
Suspicious PowerShell With Reversed HTTP String (via process_creation)
Pivot detection · T1027 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.