Windows PowerShell: FromBase64String Decoding of Gzip Archive in Script Block

Identifies PowerShell script blocks that base64-decode and Gzip-unpack embedded content using in-memory streams.

FreeUnreviewedSigmamediumv1

windows-powershell-frombase64string-decoding-of-gzip-archive-in-script-block-df69cb1d

title: "Windows PowerShell: FromBase64String Decoding of Gzip Archive in Script Block"
id: 413d1057-6316-495b-a5d6-22489afbd0eb
related:
  - id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
    type: similar
  - id: df69cb1d-b891-4cd9-90c7-d617d90100ce
    type: derived
status: test
description: This rule flags PowerShell script block text that includes base64 decoding via FromBase64String and constructs a MemoryStream, along with a Gzip header marker ('H4sI'). This pattern can be used by attackers to unpack embedded data in-memory and continue execution without touching disk. The detection relies on Script Block Logging telemetry capturing the script contents to match these string fragments.
references:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml
author: frack113, Huntrule Team
date: 2022-12-23
tags:
  - attack.command-and-control
  - attack.t1132.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - FromBase64String
      - MemoryStream
      - H4sI
  condition: selection
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1

What it detects

This rule flags PowerShell script block text that includes base64 decoding via FromBase64String and constructs a MemoryStream, along with a Gzip header marker ('H4sI'). This pattern can be used by attackers to unpack embedded data in-memory and continue execution without touching disk. The detection relies on Script Block Logging telemetry capturing the script contents to match these string fragments.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.