huntrule

Windows PowerShell Suspicious Encoded Command-Line Execution

Alerts on PowerShell launched with encoded-command switches and embedded encoded content patterns in the command line.

FreeUnreviewedSigmahighv1
title: Windows PowerShell Suspicious Encoded Command-Line Execution
id: 80c770a2-b7c9-4c69-bc4f-d115e2d85c22
status: test
description: This rule flags Windows PowerShell process creations where the command line indicates encoded execution (e.g., use of the -e/-enc switch) combined with common encoded-content patterns. Attackers often use encoded PowerShell to conceal the true script payload from casual inspection and some detections. Telemetry required is process creation data for Image/PWSh binaries and the full CommandLine text, enabling matching of both encoded switches and characteristic encoded substrings.
references:
  - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml
author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community, Huntrule Team
date: 2018-09-03
modified: 2023-04-06
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_cli_enc:
    CommandLine|contains: " -e"
  selection_cli_content:
    CommandLine|contains:
      - " JAB"
      - " SUVYI"
      - " SQBFAFgA"
      - " aQBlAHgA"
      - " aWV4I"
      - " IAA"
      - " IAB"
      - " UwB"
      - " cwB"
  selection_standalone:
    CommandLine|contains:
      - ".exe -ENCOD "
      - " BA^J e-"
  filter_optional_remote_signed:
    CommandLine|contains: " -ExecutionPolicy remotesigned "
  condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_*
level: high
license: DRL-1.1
related:
  - id: ca2092a1-c273-4878-9b4b-0d60115bf5ea
    type: derived

What it detects

This rule flags Windows PowerShell process creations where the command line indicates encoded execution (e.g., use of the -e/-enc switch) combined with common encoded-content patterns. Attackers often use encoded PowerShell to conceal the true script payload from casual inspection and some detections. Telemetry required is process creation data for Image/PWSh binaries and the full CommandLine text, enabling matching of both encoded switches and characteristic encoded substrings.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.