Windows PowerShell: Detect Command Lines with Suspicious UTF-16 Base64 Obfuscation Patterns
Alerts on PowerShell command lines containing suspicious UTF-16/Base64 obfuscation fragments indicative of hidden script logic.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-11
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation events where the PowerShell command line contains specific UTF-16/Base64-encoded string fragments and related obfuscation markers. Such encoded payloads are commonly used by attackers to hide malicious logic and reduce detection by signature-based tooling. It relies on process creation telemetry, specifically the CommandLine field, to match the presence of those encoded substrings.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-powershell-detect-command-lines-with-suspicious-utf-16-base64-obfuscatio-8d01b53f
title: "Windows PowerShell: Detect Command Lines with Suspicious UTF-16 Base64 Obfuscation Patterns"
id: 6238a787-13d7-4c31-99fc-cf52551c2dd6
status: test
description: This rule flags Windows process creation events where the PowerShell command line contains specific UTF-16/Base64-encoded string fragments and related obfuscation markers. Such encoded payloads are commonly used by attackers to hide malicious logic and reduce detection by signature-based tooling. It relies on process creation telemetry, specifically the CommandLine field, to match the presence of those encoded substrings.
references:
- https://app.any.run/tasks/fcadca91-3580-4ede-aff4-4d2bf809bf99/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_obfusc.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-11
modified: 2023-02-14
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains:
- IAAtAGIAeABvAHIAIAAwAHgA
- AALQBiAHgAbwByACAAMAB4A
- gAC0AYgB4AG8AcgAgADAAeA
- AC4ASQBuAHYAbwBrAGUAKAApACAAfAAg
- AuAEkAbgB2AG8AawBlACgAKQAgAHwAI
- ALgBJAG4AdgBvAGsAZQAoACkAIAB8AC
- AHsAMQB9AHsAMAB9ACIAIAAtAGYAI
- B7ADEAfQB7ADAAfQAiACAALQBmAC
- AewAxAH0AewAwAH0AIgAgAC0AZgAg
- AHsAMAB9AHsAMwB9ACIAIAAtAGYAI
- B7ADAAfQB7ADMAfQAiACAALQBmAC
- AewAwAH0AewAzAH0AIgAgAC0AZgAg
- AHsAMgB9AHsAMAB9ACIAIAAtAGYAI
- B7ADIAfQB7ADAAfQAiACAALQBmAC
- AewAyAH0AewAwAH0AIgAgAC0AZgAg
- AHsAMQB9AHsAMAB9ACcAIAAtAGYAI
- B7ADEAfQB7ADAAfQAnACAALQBmAC
- AewAxAH0AewAwAH0AJwAgAC0AZgAg
- AHsAMAB9AHsAMwB9ACcAIAAtAGYAI
- B7ADAAfQB7ADMAfQAnACAALQBmAC
- AewAwAH0AewAzAH0AJwAgAC0AZgAg
- AHsAMgB9AHsAMAB9ACcAIAAtAGYAI
- B7ADIAfQB7ADAAfQAnACAALQBmAC
- AewAyAH0AewAwAH0AJwAgAC0AZgAg
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 8d01b53f-456f-48ee-90f6-bc28e67d4e35
type: derived