Windows Process Creation: Detects Suspicious PowerShell Command-Line for Mercury APT Activity

Flags Windows process creations with a bypass-and-encoded PowerShell Start-Job command-line pattern linked to Mercury-related activity.

FreeUnreviewedSigmahighv1

windows-process-creation-detects-suspicious-powershell-command-line-for-mercury--a62298a3

title: "Windows Process Creation: Detects Suspicious PowerShell Command-Line for Mercury APT Activity"
id: 410e1216-9e8b-4695-bf33-f08a40143694
status: test
description: This rule matches Windows process creation events where the command line contains a specific execution pattern used to bypass and run an encoded PowerShell Start-Job script block. Attackers may use these command-line constructs to execute code while attempting to evade visibility and analysis. Telemetry relies on the Windows process creation command line string containing both the bypass/encoding markers and the encoded script content.
references:
  - https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2022/TA/MERCURY/proc_creation_win_apt_mercury.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-26
modified: 2023-03-10
tags:
  - attack.execution
  - attack.t1059.001
  - attack.g0069
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - -exec bypass -w 1 -enc
      - UwB0AGEAcgB0AC0ASgBvAGIAIAAtAFMAYwByAGkAcAB0AEIAbABvAGMAawAgAHsAKABzAGEAcABzACAAKAAiAHAA
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: a62298a3-1fe0-422f-9a68-ffbcbc5a123d
    type: derived

What it detects

This rule matches Windows process creation events where the command line contains a specific execution pattern used to bypass and run an encoded PowerShell Start-Job script block. Attackers may use these command-line constructs to execute code while attempting to evade visibility and analysis. Telemetry relies on the Windows process creation command line string containing both the bypass/encoding markers and the encoded script content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.