huntrule

Windows PowerShell Base64-Encoded WMI Class Invocation

Flags PowerShell command lines containing Base64 fragments indicative of WMI class usage (e.g., ShadowCopy, ScheduledJob) on Windows.

FreeUnreviewedSigmahighv1
title: Windows PowerShell Base64-Encoded WMI Class Invocation
id: b37ecd91-4255-4caf-8de3-077d3164ccad
related:
  - id: 47688f1b-9f51-4656-b013-3cc49a166a36
    type: obsolete
  - id: 1816994b-42e1-4fb1-afd2-134d88184f71
    type: derived
status: test
description: This rule identifies process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains Base64-like fragments corresponding to WMI class names such as Win32_ShadowCopy, Win32_ScheduledJob, Win32_Process, Win32_UserAccount, and Win32_LoggedOnUser. Attackers may encode WMI-related payloads to obscure intent and evade simple command-line inspections. The detection relies on process creation telemetry, specifically the executable path and command-line contents of PowerShell executions containing those encoded class indicators.
references:
  - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml
author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-30
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cli_shadowcopy:
    CommandLine|contains:
      - VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ
      - cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA
      - XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A
      - V2luMzJfU2hhZG93Y29we
      - dpbjMyX1NoYWRvd2NvcH
      - XaW4zMl9TaGFkb3djb3B5
  selection_cli_scheduledJob:
    CommandLine|contains:
      - VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA
      - cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA
      - XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg
      - V2luMzJfU2NoZWR1bGVkSm9i
      - dpbjMyX1NjaGVkdWxlZEpvY
      - XaW4zMl9TY2hlZHVsZWRKb2
  selection_cli_process:
    CommandLine|contains:
      - VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw
      - cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA
      - XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA
      - V2luMzJfUHJvY2Vzc
      - dpbjMyX1Byb2Nlc3
      - XaW4zMl9Qcm9jZXNz
  selection_cli_useraccount:
    CommandLine|contains:
      - VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A
      - cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA
      - XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA
      - V2luMzJfVXNlckFjY291bn
      - dpbjMyX1VzZXJBY2NvdW50
      - XaW4zMl9Vc2VyQWNjb3Vud
  selection_cli_loggedonuser:
    CommandLine|contains:
      - VwBpAG4AMwAyAF8ATABvAGcAZwBlAGQATwBuAFUAcwBlAHIA
      - cAaQBuADMAMgBfAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByA
      - XAGkAbgAzADIAXwBMAG8AZwBnAGUAZABPAG4AVQBzAGUAcg
      - V2luMzJfTG9nZ2VkT25Vc2Vy
      - dpbjMyX0xvZ2dlZE9uVXNlc
      - XaW4zMl9Mb2dnZWRPblVzZX
  condition: selection_img and 1 of selection_cli_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains Base64-like fragments corresponding to WMI class names such as Win32_ShadowCopy, Win32_ScheduledJob, Win32_Process, Win32_UserAccount, and Win32_LoggedOnUser. Attackers may encode WMI-related payloads to obscure intent and evade simple command-line inspections. The detection relies on process creation telemetry, specifically the executable path and command-line contents of PowerShell executions containing those encoded class indicators.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.