Windows PowerShell Base64-encoded Shellcode in Script Block Text

Flags PowerShell script blocks containing Base64 strings matching known shellcode markers.

FreeUnreviewedSigmahighv1

windows-powershell-base64-encoded-shellcode-in-script-block-text-16b37b70

title: Windows PowerShell Base64-encoded Shellcode in Script Block Text
id: 0483279a-782e-4c3c-b814-4a05e5fab68a
status: test
description: This rule identifies PowerShell script block content that contains specific Base64-encoded sequences associated with shellcode payloads. Attackers may use encoded script content to hide malicious instructions and execute payloads with reduced visibility. The detection relies on Script Block Logging telemetry, specifically the script block text captured by PowerShell.
references:
  - https://twitter.com/cyb3rops/status/1063072865992523776
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml
author: David Ledbetter (shellcode), Florian Roth (Nextron Systems), Huntrule Team
date: 2018-11-17
modified: 2024-01-25
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - OiCAAAAYInlM
      - OiJAAAAYInlM
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 16b37b70-6fcf-4814-a092-c36bd3aafcbd
    type: derived

What it detects

This rule identifies PowerShell script block content that contains specific Base64-encoded sequences associated with shellcode payloads. Attackers may use encoded script content to hide malicious instructions and execute payloads with reduced visibility. The detection relies on Script Block Logging telemetry, specifically the script block text captured by PowerShell.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.