Windows PowerShell Obfuscation Using COMPRESS and ASCII Encoding

Flags PowerShell process creation command lines that use ASCII encoding plus compression/stream-reading patterns associated with obfuscation.

FreeUnreviewedSigmamediumv1

windows-powershell-obfuscation-using-compress-and-ascii-encoding-7eedcc9d

title: Windows PowerShell Obfuscation Using COMPRESS and ASCII Encoding
id: fb2709c0-f040-4bb4-a1bb-3d6be982ae98
status: test
description: This rule identifies PowerShell command lines that combine object creation with ASCII encoding and string processing indicative of script obfuscation. Attackers commonly use such techniques to hide malicious logic from casual review and some static detections. It relies on process creation telemetry capturing the full command line and matching specific substrings related to encoding and compression/stream reading.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-12-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - new-object
      - text.encoding]::ascii
    CommandLine|contains:
      - system.io.compression.deflatestream
      - system.io.streamreader
      - readtoend(
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 7eedcc9d-9fdb-4d94-9c54-474e8affc0c7
    type: derived

What it detects

This rule identifies PowerShell command lines that combine object creation with ASCII encoding and string processing indicative of script obfuscation. Attackers commonly use such techniques to hide malicious logic from casual review and some static detections. It relies on process creation telemetry capturing the full command line and matching specific substrings related to encoding and compression/stream reading.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.