huntrule

Windows Process Creation: Base64-Obfuscated .NET Reflection Assembly Load Call

Alerts on command lines containing Base64-encoded obfuscation for .NET reflection assembly load calls.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Base64-Obfuscated .NET Reflection Assembly Load Call"
id: bc5431f7-5023-45b0-904c-5e70255ef5c1
related:
  - id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59
    type: similar
  - id: 9c0295ce-d60d-40bd-bd74-84673b7592b1
    type: derived
status: test
description: This rule flags Windows process creation events whose command line contains specific Base64-encoded strings that reconstruct an obfuscated .NET reflection.assembly load keyword. Attackers may use encoding and string concatenation to evade simple keyword matching and to conceal dynamic assembly loading behavior. It relies on process_creation telemetry with access to the full command line text.
references:
  - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar
  - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
  - https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml
author: pH-T (Nextron Systems), Huntrule Team
date: 2022-03-01
modified: 2023-04-06
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ
      - oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA
      - 6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA
      - OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ
      - oAOgAoACIATABvACIAKwAiAGEAZAAiACkA
      - 6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA
      - OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ
      - oAOgAoACIATABvAGEAIgArACIAZAAiACkA
      - 6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA
      - OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ
      - oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA
      - 6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA
      - OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ
      - oAOgAoACcATABvACcAKwAnAGEAZAAnACkA
      - 6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA
      - OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ
      - oAOgAoACcATABvAGEAJwArACcAZAAnACkA
      - 6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1

What it detects

This rule flags Windows process creation events whose command line contains specific Base64-encoded strings that reconstruct an obfuscated .NET reflection.assembly load keyword. Attackers may use encoding and string concatenation to evade simple keyword matching and to conceal dynamic assembly loading behavior. It relies on process_creation telemetry with access to the full command line text.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.