Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )

Flags PowerShell executions using the -e encoded command flag with Base64 patterns consistent with an Invoke- call.

FreeUnreviewedSigmahighv1

windows-powershell-base64-encoded-commands-containing-invoke-e-6385697e

title: Windows PowerShell Base64 Encoded Commands Containing Invoke- ( -e )
id: 0d4d59a8-d8fe-4c56-85b5-daaddfeb4b11
related:
  - id: fd6e2919-3936-40c9-99db-0aa922c356f7
    type: obsolete
  - id: 6385697e-9f1b-40bd-8817-f4a91f40508e
    type: derived
status: test
description: This rule identifies process executions of PowerShell (powershell.exe or pwsh.exe) where the command line includes the encoded command flag (-e) and the encoded payload matches Base64 fragments consistent with an 'Invoke-' call. Attackers frequently use Base64-encoded PowerShell to obscure script content and reduce casual inspection. The detection relies on process creation telemetry including the executable path and the raw command-line string.
references:
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml
author: pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t, Huntrule Team
date: 2022-05-20
modified: 2023-04-06
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cli_enc:
    CommandLine|contains: " -e"
  selection_cli_invoke:
    CommandLine|contains:
      - SQBuAHYAbwBrAGUALQ
      - kAbgB2AG8AawBlAC0A
      - JAG4AdgBvAGsAZQAtA
      - SW52b2tlL
      - ludm9rZS
      - JbnZva2Ut
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
simulation:
  - type: atomic red team
    name: Create a Process using WMI Query and an Encoded Command
    technique: T1047
    atomic_guid: 7db7a7f9-9531-4840-9b30-46220135441c
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_powershell_base64_invoke/info.yml
license: DRL-1.1

What it detects

This rule identifies process executions of PowerShell (powershell.exe or pwsh.exe) where the command line includes the encoded command flag (-e) and the encoded payload matches Base64 fragments consistent with an 'Invoke-' call. Attackers frequently use Base64-encoded PowerShell to obscure script content and reduce casual inspection. The detection relies on process creation telemetry including the executable path and the raw command-line string.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.