huntrule

Windows PowerShell Base64 Command Line Executing IEX

Identifies Windows PowerShell processes with Base64-encoded command-line content that contains an IEX execution pattern.

FreeUnreviewedSigmahighv1
title: Windows PowerShell Base64 Command Line Executing IEX
id: b1d5771e-4e40-4261-8c4f-e47909ed47a6
status: test
description: This rule flags Windows process command lines that include a Base64-like payload containing an encoded "IEX" invocation. Attackers commonly use IEX to execute attacker-supplied PowerShell code, and encoding can help evade simple command-line inspection. The detection relies on process creation telemetry, matching specific Base64 substrings and encoded "IEX" patterns in the CommandLine field.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_iex.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-08-23
modified: 2023-04-06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - CommandLine|base64offset|contains:
        - IEX ([
        - iex ([
        - iex (New
        - IEX (New
        - IEX([
        - iex([
        - iex(New
        - IEX(New
        - IEX(('
        - iex(('
    - CommandLine|contains:
        - SQBFAFgAIAAoAFsA
        - kARQBYACAAKABbA
        - JAEUAWAAgACgAWw
        - aQBlAHgAIAAoAFsA
        - kAZQB4ACAAKABbA
        - pAGUAeAAgACgAWw
        - aQBlAHgAIAAoAE4AZQB3A
        - kAZQB4ACAAKABOAGUAdw
        - pAGUAeAAgACgATgBlAHcA
        - SQBFAFgAIAAoAE4AZQB3A
        - kARQBYACAAKABOAGUAdw
        - JAEUAWAAgACgATgBlAHcA
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 88f680b8-070e-402c-ae11-d2914f2257f1
    type: derived

What it detects

This rule flags Windows process command lines that include a Base64-like payload containing an encoded "IEX" invocation. Attackers commonly use IEX to execute attacker-supplied PowerShell code, and encoding can help evade simple command-line inspection. The detection relies on process creation telemetry, matching specific Base64 substrings and encoded "IEX" patterns in the CommandLine field.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.