Windows PowerShell: Alert on Unusually Long CommandLine Length (1000+ Characters)

title: "Windows PowerShell: Alert on Unusually Long CommandLine Length (1000+ Characters)"
id: 02f0ca9c-37fb-4b5e-8cce-1f77b972a3c6
status: test
description: This rule flags Windows process creation events where the executable is PowerShell (powershell.exe or pwsh.exe) and the CommandLine is 1000 characters or longer. Attackers commonly use long command lines to pack scripts, obfuscation, or extensive arguments into a single execution step. The detection relies on process creation telemetry, specifically the Image/OriginalFileName and the full CommandLine string length.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_abnormal_commandline_size.yml
author: oscd.community, Natalia Shornikova, Huntrule Team
date: 2020-10-06
modified: 2023-04-14
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
    - Description: Windows Powershell
    - Product: PowerShell Core 6
  selection_length:
    CommandLine|re: .{1000,}
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d0d28567-4b9a-45e2-8bbc-fb1b66a1f7f6
    type: derived