Windows PowerShell Module: Obfuscated cmd/set Environment Variable Launcher Behavior

title: "Windows PowerShell Module: Obfuscated cmd/set Environment Variable Launcher Behavior"
id: 59333121-79f0-4b8a-ac93-9559ac6e63ee
related:
  - id: 0adfbc14-0ed1-11eb-adc1-0242ac120002
    type: derived
  - id: 6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e
    type: derived
status: test
description: This rule flags PowerShell module activity where the command-line payload matches an obfuscated pattern using cmd /c or cmd /r combined with set of environment variables. Attackers use environment-variable indirection to hide the real executed command and reduce the effectiveness of simple string-based detections. The rule relies on PowerShell module telemetry that exposes the payload content and matches it against a specific cmd/set obfuscation regular expression.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml
author: Jonathan Cheong, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2024-04-05
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|re: cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*"
  condition: selection_4103
falsepositives:
  - Unknown
level: high
license: DRL-1.1