Windows PowerShell Process Command Lines With Encoded Command Flags

Alerts on PowerShell (pwsh) command lines using encoded command flags and encoded-looking substrings, excluding gc_worker.exe-related activity.

FreeUnreviewedSigmahighv1

windows-powershell-process-command-lines-with-encoded-command-flags-b9d9cc83

title: Windows PowerShell Process Command Lines With Encoded Command Flags
id: e44119d2-8ed1-456e-bf46-6b1b426263f3
status: test
description: This rule flags Windows PowerShell or pwsh process creation events where the command line includes common encoded command options (e.g., -e/-enc) and additional command-line substrings typically seen in encoded payloads. Attackers often use encoded PowerShell to obscure script contents and evade simple command-line inspection. It relies on Windows process creation telemetry, matching Image/OriginalFileName for PowerShell and scanning CommandLine for the specified encoded patterns while excluding activity tied to a specific guest configuration worker process path.
references:
  - https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-05-24
modified: 2023-01-05
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.Exe
        - pwsh.dll
  selection_flags:
    CommandLine|contains:
      - " -e "
      - " -en "
      - " -enc "
      - " -enco"
  selection_encoded:
    CommandLine|contains:
      - " JAB"
      - " SUVYI"
      - " SQBFAFgA"
      - " aWV4I"
      - " IAB"
      - " PAA"
      - " aQBlAHgA"
  filter_gcworker:
    ParentImage|contains:
      - C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\
      - \gc_worker.exe
  condition: all of selection_* and not 1 of filter_*
falsepositives:
  - Other tools that work with encoded scripts in the command line instead of script files
level: high
license: DRL-1.1
related:
  - id: b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c
    type: derived

What it detects

This rule flags Windows PowerShell or pwsh process creation events where the command line includes common encoded command options (e.g., -e/-enc) and additional command-line substrings typically seen in encoded payloads. Attackers often use encoded PowerShell to obscure script contents and evade simple command-line inspection. It relies on Windows process creation telemetry, matching Image/OriginalFileName for PowerShell and scanning CommandLine for the specified encoded patterns while excluding activity tied to a specific guest configuration worker process path.

Known false positives

Other tools that work with encoded scripts in the command line instead of script files

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.