huntrule

Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building

Detects PowerShell command lines containing type-conversion and join/split character assembly indicators consistent with encoded content handling.

FreeUnreviewedSigmalowv1
title: Windows PowerShell Command Line Encoded-Content Indicators via Type Conversion and String Building
id: 2db9daf1-f3dc-4a08-8704-5e680fdcb06e
related:
  - id: 5b572dcf-254b-425c-a8c5-d9af6bea35a6
    type: similar
  - id: cdf05894-89e7-4ead-b2b0-0a5f97a90f2f
    type: derived
status: test
description: This rule flags Windows process creation events where the executable is PowerShell (powershell.exe or pwsh.exe) and the command line includes specific method names consistent with encoded or transformed content handling (e.g., ToInt/ToDecimal/ToByte/ToString). It also looks for string construction patterns using combinations of 'char' with 'join' or 'split' with 'join'. Attackers often use PowerShell command-line encoding and transformation to obscure payloads and evade casual inspection, making these command-line telemetry fields valuable for detection.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml
author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton, Huntrule Team
date: 2020-10-11
modified: 2023-01-26
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_to_1:
    CommandLine|contains:
      - ToInt
      - ToDecimal
      - ToByte
      - ToUint
      - ToSingle
      - ToSByte
  selection_to_2:
    CommandLine|contains:
      - ToChar
      - ToString
      - String
  selection_gen_1:
    CommandLine|contains|all:
      - char
      - join
  selection_gen_2:
    CommandLine|contains|all:
      - split
      - join
  condition: selection_img and (all of selection_to_* or 1 of selection_gen_*)
falsepositives:
  - Unknown
level: low
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the executable is PowerShell (powershell.exe or pwsh.exe) and the command line includes specific method names consistent with encoded or transformed content handling (e.g., ToInt/ToDecimal/ToByte/ToString). It also looks for string construction patterns using combinations of 'char' with 'join' or 'split' with 'join'. Attackers often use PowerShell command-line encoding and transformation to obscure payloads and evade casual inspection, making these command-line telemetry fields valuable for detection.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.