huntrule

Windows PowerShell: Base64 Encoded Reflective .NET Assembly Load

Flags PowerShell command lines containing Base64 fragments consistent with reflective .NET Assembly.Load usage.

FreeUnreviewedSigmahighv1
title: "Windows PowerShell: Base64 Encoded Reflective .NET Assembly Load"
id: 2cae904b-6129-4723-ab70-ed10e4e70eb1
related:
  - id: 9c0295ce-d60d-40bd-bd74-84673b7592b1
    type: similar
  - id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59
    type: derived
status: test
description: This rule identifies PowerShell process command lines containing Base64-encoded content that corresponds to reflective .NET assembly loading patterns. Attackers commonly use encoded payloads to reduce detection and stage in-memory execution without writing readable artifacts to disk. The detection relies on Windows process creation telemetry and substring matches on specific Base64 fragments representing calls like Reflection.Assembly.Load.
references:
  - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml
author: Christian Burkard (Nextron Systems), pH-T (Nextron Systems), Huntrule Team
date: 2022-03-01
modified: 2023-01-30
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1027
  - attack.t1620
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA
      - sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA
      - bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA
      - AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiAC
      - BbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgAp
      - AWwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAK
      - WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAKQ
      - sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiACkA
      - bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgApA
      - WwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA
      - sAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA
      - bAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule identifies PowerShell process command lines containing Base64-encoded content that corresponds to reflective .NET assembly loading patterns. Attackers commonly use encoded payloads to reduce detection and stage in-memory execution without writing readable artifacts to disk. The detection relies on Windows process creation telemetry and substring matches on specific Base64 fragments representing calls like Reflection.Assembly.Load.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.