Windows PowerShell Process Creation: Suspicious Base64/Encoded and IEX WebClient Patterns
Detects suspicious PowerShell process command lines using hidden/no-profile, execution-policy bypass, and encoded/Base64 or IEX WebClient download patterns.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-05
- Updated
- 2026-07-30
What it detects
This rule flags Windows process creation events where the PowerShell command line includes multiple indicators associated with stealthy execution and encoded payload handling, such as no-profile/hidden window, bypassed execution policy, and use of Base64 decoding or -Enc. It also matches command lines that combine hidden/window-style flags with IEX and New-Object patterns, including web download usage via .Download from WebClient. The detection relies on CommandLine string telemetry in process creation logs to identify these specific parameter combinations while excluding known Chocolatey installer-related content.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell Process Creation: Suspicious Base64/Encoded and IEX WebClient Patterns"
id: 8c835807-8df1-4f50-a91c-08bfd48e455e
related:
- id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c
type: obsolete
- id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71
type: similar
- id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090
type: similar
- id: 536e2947-3729-478c-9903-745aaffe60d2
type: derived
status: test
description: This rule flags Windows process creation events where the PowerShell command line includes multiple indicators associated with stealthy execution and encoded payload handling, such as no-profile/hidden window, bypassed execution policy, and use of Base64 decoding or -Enc. It also matches command lines that combine hidden/window-style flags with IEX and New-Object patterns, including web download usage via .Download from WebClient. The detection relies on CommandLine string telemetry in process creation logs to identify these specific parameter combinations while excluding known Chocolatey installer-related content.
references:
- Internal Research
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_invocation_specific.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-05
tags:
- attack.stealth
logsource:
category: process_creation
product: windows
detection:
selection_convert_b64:
CommandLine|contains|all:
- -nop
- " -w "
- hidden
- " -c "
- "[Convert]::FromBase64String"
selection_iex:
CommandLine|contains|all:
- " -w "
- hidden
- -noni
- -nop
- " -c "
- iex
- New-Object
selection_enc:
CommandLine|contains|all:
- " -w "
- hidden
- -ep
- bypass
- -Enc
selection_reg:
CommandLine|contains|all:
- powershell
- reg
- add
- \software\
selection_webclient:
CommandLine|contains|all:
- bypass
- -noprofile
- -windowstyle
- hidden
- new-object
- system.net.webclient
- .download
selection_iex_webclient:
CommandLine|contains|all:
- iex
- New-Object
- Net.WebClient
- .Download
filter_chocolatey:
CommandLine|contains:
- (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1
- Write-ChocolateyWarning
condition: 1 of selection_* and not 1 of filter_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1