Windows PowerShell Process Creation: Suspicious Base64/Encoded and IEX WebClient Patterns

Detects suspicious PowerShell process command lines using hidden/no-profile, execution-policy bypass, and encoded/Base64 or IEX WebClient download patterns.

FreeUnreviewedSigmamediumv1

windows-powershell-process-creation-suspicious-base64-encoded-and-iex-webclient--536e2947

title: "Windows PowerShell Process Creation: Suspicious Base64/Encoded and IEX WebClient Patterns"
id: 8c835807-8df1-4f50-a91c-08bfd48e455e
related:
  - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c
    type: obsolete
  - id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71
    type: similar
  - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090
    type: similar
  - id: 536e2947-3729-478c-9903-745aaffe60d2
    type: derived
status: test
description: This rule flags Windows process creation events where the PowerShell command line includes multiple indicators associated with stealthy execution and encoded payload handling, such as no-profile/hidden window, bypassed execution policy, and use of Base64 decoding or -Enc. It also matches command lines that combine hidden/window-style flags with IEX and New-Object patterns, including web download usage via .Download from WebClient. The detection relies on CommandLine string telemetry in process creation logs to identify these specific parameter combinations while excluding known Chocolatey installer-related content.
references:
  - Internal Research
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_invocation_specific.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-05
tags:
  - attack.stealth
logsource:
  category: process_creation
  product: windows
detection:
  selection_convert_b64:
    CommandLine|contains|all:
      - -nop
      - " -w "
      - hidden
      - " -c "
      - "[Convert]::FromBase64String"
  selection_iex:
    CommandLine|contains|all:
      - " -w "
      - hidden
      - -noni
      - -nop
      - " -c "
      - iex
      - New-Object
  selection_enc:
    CommandLine|contains|all:
      - " -w "
      - hidden
      - -ep
      - bypass
      - -Enc
  selection_reg:
    CommandLine|contains|all:
      - powershell
      - reg
      - add
      - \software\
  selection_webclient:
    CommandLine|contains|all:
      - bypass
      - -noprofile
      - -windowstyle
      - hidden
      - new-object
      - system.net.webclient
      - .download
  selection_iex_webclient:
    CommandLine|contains|all:
      - iex
      - New-Object
      - Net.WebClient
      - .Download
  filter_chocolatey:
    CommandLine|contains:
      - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1
      - Write-ChocolateyWarning
  condition: 1 of selection_* and not 1 of filter_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags Windows process creation events where the PowerShell command line includes multiple indicators associated with stealthy execution and encoded payload handling, such as no-profile/hidden window, bypassed execution policy, and use of Base64 decoding or -Enc. It also matches command lines that combine hidden/window-style flags with IEX and New-Object patterns, including web download usage via .Download from WebClient. The detection relies on CommandLine string telemetry in process creation logs to identify these specific parameter combinations while excluding known Chocolatey installer-related content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.