Windows PowerShell execution via obfuscated cmdstdin input (Event ID 4697)

title: Windows PowerShell execution via obfuscated cmdstdin input (Event ID 4697)
id: ab8abae0-89f5-4ed7-95c3-ef38015daf5c
related:
  - id: 72862bf2-0eb1-11eb-adc1-0242ac120002
    type: derived
  - id: 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974
    type: derived
status: test
description: This rule flags Windows security events where a service installation (Event ID 4697) references cmd invoking PowerShell with indicators of stdin-style input obfuscation. Attackers can use this pattern to conceal execution parameters while still launching PowerShell for follow-on activity. The detection relies on audit telemetry from Security logs capturing the ServiceFileName content used during service creation.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains|all:
      - cmd
      - powershell
  selection2:
    ServiceFileName|contains:
      - ${input}
      - noexit
  selection3:
    ServiceFileName|contains:
      - " /c "
      - " /r "
  condition: all of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1