huntrule

Windows PowerShell Base64-encoded shellcode in ScriptBlockText

Flags PowerShell script blocks containing Base64 strings matching known shellcode markers.

FreeReviewedSigma · High · v2
Product
windows
Category
ps_script
Author
David Ledbetter (shellcode), Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2018-11-17
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags PowerShell script block content that contains specific Base64-encoded sequences associated with embedded shellcode. Attackers may use Base64 to conceal payloads within otherwise normal-looking PowerShell execution, aiming to increase stealth. The detection relies on Script Block Logging telemetry by matching the presence of the defined encoded markers in the captured ScriptBlockText.

Reporting behind it

Related detections9 linkedT1059.001 — drag to rearrange
Suspicious PowerShell Shellcode Loader via Function Pointer Delegate
Malicious PowerShell Runtime Loaded Outside PowerShell Host
Suspicious AutoIt Interpreter Launched by Script Host or Shell
Malicious Metasploit Stager Delivery via mshta Remote HTA (via process_creation)
Suspicious PowerShell Download of Disguised Payload to ProgramData
Suspicious PowerShell WebClient Download of Executable Payload
Malicious Script Host Spawning PowerShell in Gootloader Chain
Suspicious PsExec Service Launching Encoded PowerShell Payload
Suspicious PowerShell Remote Script Execution via IEX DownloadString
Windows PowerShell Base64-encoded shellcode in ScriptBlockText
Pivot detection · T1059.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.