Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)

title: Windows PowerShell Process Creation with Unusually Long Command Lines (1000+ chars)
id: 02f0ca9c-37fb-4b5e-8cce-1f77b972a3c6
status: test
description: This rule flags Windows processes running PowerShell executables when the CommandLine length is 1000 characters or more. Attackers often pack payloads, scripts, or encoded content into a single command line to evade simpler detections. The detection relies on process creation telemetry, matching PowerShell/pwsh process paths and the measured CommandLine length.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_abnormal_commandline_size.yml
author: oscd.community, Natalia Shornikova, Huntrule Team
date: 2020-10-06
modified: 2023-04-14
tags:
  - attack.execution
  - attack.t1059.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
    - Description: Windows Powershell
    - Product: PowerShell Core 6
  selection_length:
    CommandLine|re: .{1000,}
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d0d28567-4b9a-45e2-8bbc-fb1b66a1f7f6
    type: derived