Windows PowerShell detects obfuscated Net.Webclient casing anomalies in command line

title: Windows PowerShell detects obfuscated Net.Webclient casing anomalies in command line
id: ea38176a-0ba8-4580-9b22-1e672693bfcb
status: test
description: This rule flags Windows process creations where PowerShell or pwsh is used and the command line contains encoded fragments consistent with obfuscation plus an abnormal mixed-case reference to Net.Webclient. Attackers commonly vary casing to evade simple string-based detections, including around commonly abused .NET types used for web requests. Telemetry required includes process creation events with process image path/name and the full PowerShell command line content.
references:
  - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-24
modified: 2023-01-05
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_encoded:
    CommandLine|contains:
      - TgBlAFQALgB3AEUAQg
      - 4AZQBUAC4AdwBFAEIA
      - OAGUAVAAuAHcARQBCA
      - bgBFAHQALgB3AGUAYg
      - 4ARQB0AC4AdwBlAGIA
      - uAEUAdAAuAHcAZQBiA
      - TgBFAHQALgB3AGUAYg
      - OAEUAdAAuAHcAZQBiA
      - bgBlAFQALgB3AGUAYg
      - 4AZQBUAC4AdwBlAGIA
      - uAGUAVAAuAHcAZQBiA
      - TgBlAFQALgB3AGUAYg
      - OAGUAVAAuAHcAZQBiA
      - bgBFAFQALgB3AGUAYg
      - 4ARQBUAC4AdwBlAGIA
      - uAEUAVAAuAHcAZQBiA
      - bgBlAHQALgBXAGUAYg
      - 4AZQB0AC4AVwBlAGIA
      - uAGUAdAAuAFcAZQBiA
      - bgBFAHQALgBXAGUAYg
      - 4ARQB0AC4AVwBlAGIA
      - uAEUAdAAuAFcAZQBiA
      - TgBFAHQALgBXAGUAYg
      - OAEUAdAAuAFcAZQBiA
      - bgBlAFQALgBXAGUAYg
      - 4AZQBUAC4AVwBlAGIA
      - uAGUAVAAuAFcAZQBiA
      - TgBlAFQALgBXAGUAYg
      - OAGUAVAAuAFcAZQBiA
      - bgBFAFQALgBXAGUAYg
      - 4ARQBUAC4AVwBlAGIA
      - uAEUAVAAuAFcAZQBiA
      - bgBlAHQALgB3AEUAYg
      - 4AZQB0AC4AdwBFAGIA
      - uAGUAdAAuAHcARQBiA
      - TgBlAHQALgB3AEUAYg
      - OAGUAdAAuAHcARQBiA
      - bgBFAHQALgB3AEUAYg
      - 4ARQB0AC4AdwBFAGIA
      - uAEUAdAAuAHcARQBiA
      - TgBFAHQALgB3AEUAYg
      - OAEUAdAAuAHcARQBiA
      - bgBlAFQALgB3AEUAYg
      - 4AZQBUAC4AdwBFAGIA
      - uAGUAVAAuAHcARQBiA
      - TgBlAFQALgB3AEUAYg
      - OAGUAVAAuAHcARQBiA
      - bgBFAFQALgB3AEUAYg
      - 4ARQBUAC4AdwBFAGIA
      - uAEUAVAAuAHcARQBiA
      - TgBFAFQALgB3AEUAYg
      - OAEUAVAAuAHcARQBiA
      - bgBlAHQALgBXAEUAYg
      - 4AZQB0AC4AVwBFAGIA
      - uAGUAdAAuAFcARQBiA
      - TgBlAHQALgBXAEUAYg
      - OAGUAdAAuAFcARQBiA
      - bgBFAHQALgBXAEUAYg
      - 4ARQB0AC4AVwBFAGIA
      - uAEUAdAAuAFcARQBiA
      - TgBFAHQALgBXAEUAYg
      - OAEUAdAAuAFcARQBiA
      - bgBlAFQALgBXAEUAYg
      - 4AZQBUAC4AVwBFAGIA
      - uAGUAVAAuAFcARQBiA
      - TgBlAFQALgBXAEUAYg
      - OAGUAVAAuAFcARQBiA
      - bgBFAFQALgBXAEUAYg
      - 4ARQBUAC4AVwBFAGIA
      - uAEUAVAAuAFcARQBiA
      - TgBFAFQALgBXAEUAYg
      - OAEUAVAAuAFcARQBiA
      - bgBlAHQALgB3AGUAQg
      - 4AZQB0AC4AdwBlAEIA
      - uAGUAdAAuAHcAZQBCA
      - TgBlAHQALgB3AGUAQg
      - OAGUAdAAuAHcAZQBCA
      - bgBFAHQALgB3AGUAQg
      - 4ARQB0AC4AdwBlAEIA
      - uAEUAdAAuAHcAZQBCA
      - TgBFAHQALgB3AGUAQg
      - OAEUAdAAuAHcAZQBCA
      - bgBlAFQALgB3AGUAQg
      - 4AZQBUAC4AdwBlAEIA
      - uAGUAVAAuAHcAZQBCA
      - TgBlAFQALgB3AGUAQg
      - OAGUAVAAuAHcAZQBCA
      - bgBFAFQALgB3AGUAQg
      - 4ARQBUAC4AdwBlAEIA
      - uAEUAVAAuAHcAZQBCA
      - TgBFAFQALgB3AGUAQg
      - OAEUAVAAuAHcAZQBCA
      - bgBlAHQALgBXAGUAQg
      - 4AZQB0AC4AVwBlAEIA
      - uAGUAdAAuAFcAZQBCA
      - TgBlAHQALgBXAGUAQg
      - OAGUAdAAuAFcAZQBCA
      - bgBFAHQALgBXAGUAQg
      - 4ARQB0AC4AVwBlAEIA
      - uAEUAdAAuAFcAZQBCA
      - TgBFAHQALgBXAGUAQg
      - OAEUAdAAuAFcAZQBCA
      - bgBlAFQALgBXAGUAQg
      - 4AZQBUAC4AVwBlAEIA
      - uAGUAVAAuAFcAZQBCA
      - TgBlAFQALgBXAGUAQg
      - OAGUAVAAuAFcAZQBCA
      - bgBFAFQALgBXAGUAQg
      - 4ARQBUAC4AVwBlAEIA
      - uAEUAVAAuAFcAZQBCA
      - TgBFAFQALgBXAGUAQg
      - OAEUAVAAuAFcAZQBCA
      - bgBlAHQALgB3AEUAQg
      - 4AZQB0AC4AdwBFAEIA
      - uAGUAdAAuAHcARQBCA
      - TgBlAHQALgB3AEUAQg
      - OAGUAdAAuAHcARQBCA
      - bgBFAHQALgB3AEUAQg
      - 4ARQB0AC4AdwBFAEIA
      - uAEUAdAAuAHcARQBCA
      - TgBFAHQALgB3AEUAQg
      - OAEUAdAAuAHcARQBCA
      - bgBlAFQALgB3AEUAQg
      - uAGUAVAAuAHcARQBCA
      - bgBFAFQALgB3AEUAQg
      - 4ARQBUAC4AdwBFAEIA
      - uAEUAVAAuAHcARQBCA
      - TgBFAFQALgB3AEUAQg
      - OAEUAVAAuAHcARQBCA
      - TgBlAHQALgBXAEUAQg
      - 4AZQB0AC4AVwBFAEIA
      - OAGUAdAAuAFcARQBCA
      - bgBFAHQALgBXAEUAQg
      - 4ARQB0AC4AVwBFAEIA
      - uAEUAdAAuAFcARQBCA
      - TgBFAHQALgBXAEUAQg
      - OAEUAdAAuAFcARQBCA
      - bgBlAFQALgBXAEUAQg
      - 4AZQBUAC4AVwBFAEIA
      - uAGUAVAAuAFcARQBCA
      - TgBlAFQALgBXAEUAQg
      - OAGUAVAAuAFcARQBCA
      - bgBFAFQALgBXAEUAQg
      - 4ARQBUAC4AVwBFAEIA
      - uAEUAVAAuAFcARQBCA
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: c86133ad-4725-4bd0-8170-210788e0a7ba
    type: derived