huntrule

Windows Process Creation: Emotet-like PowerShell/WMI Command-Line Indicators

Alerts on Windows process executions with command-line indicators consistent with Emotet-like staging and encoded payload usage.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Emotet-like PowerShell/WMI Command-Line Indicators"
id: a95c7bde-9693-4c2a-b8b2-8df529fda32a
status: stable
description: This rule flags Windows process creation events whose command lines contain specific Emotet-like execution patterns, including encoded user-profile and temp-path references as well as suspicious string fragments. The behavior matters because malware frequently uses command-line construction and encoding to stage or run payloads while evading simpler detections. It relies on process_creation telemetry, specifically the CommandLine field, and applies a set of command-line substrings to reduce matching known benign patterns.
references:
  - https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/
  - https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
  - https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/
  - https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2019/Malware/Emotet/proc_creation_win_malware_emotet.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-09-30
modified: 2023-02-04
tags:
  - attack.execution
  - attack.stealth
  - attack.t1059.001
  - attack.t1027
  - detection.emerging-threats
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - " -e* PAA"
      - JABlAG4AdgA6AHUAcwBlAHIAcAByAG8AZgBpAGwAZQ
      - QAZQBuAHYAOgB1AHMAZQByAHAAcgBvAGYAaQBsAGUA
      - kAGUAbgB2ADoAdQBzAGUAcgBwAHIAbwBmAGkAbABlA
      - IgAoACcAKgAnACkAOwAkA
      - IAKAAnACoAJwApADsAJA
      - iACgAJwAqACcAKQA7ACQA
      - JABGAGwAeAByAGgAYwBmAGQ
      - PQAkAGUAbgB2ADoAdABlAG0AcAArACgA
      - 0AJABlAG4AdgA6AHQAZQBtAHAAKwAoA
      - 9ACQAZQBuAHYAOgB0AGUAbQBwACsAKA
  filter:
    CommandLine|contains:
      - fAAgAEMAbwBuAHYAZQByAHQAVABvAC0ASgBzAG8AbgAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQ
      - wAIABDAG8AbgB2AGUAcgB0AFQAbwAtAEoAcwBvAG4AIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      - 8ACAAQwBvAG4AdgBlAHIAdABUAG8ALQBKAHMAbwBuACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlA
  condition: selection and not filter
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18
    type: derived

What it detects

This rule flags Windows process creation events whose command lines contain specific Emotet-like execution patterns, including encoded user-profile and temp-path references as well as suspicious string fragments. The behavior matters because malware frequently uses command-line construction and encoding to stage or run payloads while evading simpler detections. It relies on process_creation telemetry, specifically the CommandLine field, and applies a set of command-line substrings to reduce matching known benign patterns.

Known false positives

  • Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.