Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines

Alerts on suspicious PowerShell command lines that pipe or otherwise invoke IEX and may include Base64 decoding.

FreeUnreviewedSigmahighv1

windows-powershell-iex-invocation-patterns-in-process-creation-command-lines-09576804

title: Windows PowerShell IEX Invocation Patterns in Process Creation Command Lines
id: 1705c248-ca60-45c1-b3c9-cbcc0d1af410
status: test
description: This rule flags Windows process creation events where PowerShell (powershell.exe or pwsh.exe) is launched with command-line fragments that invoke IEX, including common pipe-and-iex forms and related IEX variants. Attackers often use IEX to execute dynamically generated or encoded PowerShell code, which can help payloads evade simple script-blocking and static analysis. The detection relies on process creation telemetry, specifically the executable path ending in PowerShell and command-line substrings that match IEX and Base64 decoding building blocks.
references:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2
  - https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-03-24
modified: 2022-11-28
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: process_creation
detection:
  selection_combined_1:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - " | iex;"
      - " | iex "
      - " | iex}"
      - " | IEX ;"
      - " | IEX -Error"
      - " | IEX (new"
      - ");IEX "
  selection_combined_2:
    CommandLine|contains:
      - ::FromBase64String
      - ".GetString([System.Convert]::"
  selection_standalone:
    CommandLine|contains:
      - )|iex;$
      - );iex($
      - );iex $
      - " | IEX | "
      - ' | iex\"'
  condition: all of selection_combined_* or selection_standalone
falsepositives:
  - Legitimate scripts that use IEX
level: high
license: DRL-1.1
related:
  - id: 09576804-7a05-458e-a817-eb718ca91f54
    type: derived

What it detects

This rule flags Windows process creation events where PowerShell (powershell.exe or pwsh.exe) is launched with command-line fragments that invoke IEX, including common pipe-and-iex forms and related IEX variants. Attackers often use IEX to execute dynamically generated or encoded PowerShell code, which can help payloads evade simple script-blocking and static analysis. The detection relies on process creation telemetry, specifically the executable path ending in PowerShell and command-line substrings that match IEX and Base64 decoding building blocks.

Known false positives

Legitimate scripts that use IEX

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.