huntrule

Windows PowerShell: Alias obfuscation via -Value (-join(...)) in script blocks

Flags PowerShell script blocks that set aliases using -Value with a (-join(...)) character-joining obfuscation pattern.

FreeUnreviewedSigmalowv1
title: "Windows PowerShell: Alias obfuscation via -Value (-join(...)) in script blocks"
id: c239e4f9-f87f-467e-b86c-2f05d8f90138
related:
  - id: 96cd126d-f970-49c4-848a-da3a09f55c55
    type: derived
  - id: e8314f79-564d-4f79-bc13-fbc0bf2660d8
    type: derived
status: test
description: This rule identifies PowerShell script block content that creates or sets aliases while embedding the alias value using the pattern "-Value (-join(". Attackers may use character joining to reduce readability and hinder simple string-based detection of commands and identifiers. The detection relies on telemetry from Windows PowerShell script block logging, matching on specific substrings within the ScriptBlockText field.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-09
tags:
  - attack.execution
  - attack.stealth
  - attack.t1027
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - -Alias
      - " -Value (-join("
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1

What it detects

This rule identifies PowerShell script block content that creates or sets aliases while embedding the alias value using the pattern "-Value (-join(". Attackers may use character joining to reduce readability and hinder simple string-based detection of commands and identifiers. The detection relies on telemetry from Windows PowerShell script block logging, matching on specific substrings within the ScriptBlockText field.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.