PowerShell: FromBase64String Decoding of Gzip (H4sI) into MemoryStream
Identifies PowerShell script blocks that base64-decode and Gzip-unpack embedded content using in-memory streams.
- Product
- windows
- Category
- ps_script
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-12-23
- Updated
- 2026-07-31
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
Identifies PowerShell script content that includes decoding from Base64 using FromBase64String, combined with in-memory handling via MemoryStream and a Gzip-like Base64 prefix ("H4sI"). This pattern is commonly used by attackers to package data as Base64 and then decompress/load it into memory for subsequent execution. Telemetry relies on Script Block Logging to capture the script block text containing these specific string fragments.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "PowerShell: FromBase64String Decoding of Gzip (H4sI) into MemoryStream"
id: 413d1057-6316-495b-a5d6-22489afbd0eb
related:
- id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
type: similar
- id: df69cb1d-b891-4cd9-90c7-d617d90100ce
type: derived
status: test
description: Identifies PowerShell script content that includes decoding from Base64 using FromBase64String, combined with in-memory handling via MemoryStream and a Gzip-like Base64 prefix ("H4sI"). This pattern is commonly used by attackers to package data as Base64 and then decompress/load it into memory for subsequent execution. Telemetry relies on Script Block Logging to capture the script block text containing these specific string fragments.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml
author: frack113, Huntrule Team
date: 2022-12-23
tags:
- attack.command-and-control
- attack.t1132.001
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- FromBase64String
- MemoryStream
- H4sI
condition: selection
falsepositives:
- Legitimate administrative script
level: medium
license: DRL-1.1