Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords

title: "Windows Process Creation: PowerShell Command Lines with Hidden Base64-Encoded Keywords"
id: d7aaf685-84b9-4978-9db3-a7189dedd24d
status: test
description: This rule flags Windows process creation events where PowerShell (powershell.exe/pwsh.exe) is launched with a command line containing the substring ' hidden ' and includes one or more long base64-like strings. Such obfuscation is commonly used to conceal PowerShell keywords and payload content from straightforward command-line inspection. The detection relies on process creation telemetry, including the executable path/name and the full command line.
references:
  - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml
author: John Lambert (rule), Huntrule Team
date: 2019-01-16
modified: 2023-01-05
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \powershell.exe
        - \pwsh.exe
    - OriginalFileName:
        - PowerShell.EXE
        - pwsh.dll
  selection_hidden:
    CommandLine|contains: " hidden "
  selection_encoded:
    CommandLine|contains:
      - AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA
      - aXRzYWRtaW4gL3RyYW5zZmVy
      - IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA
      - JpdHNhZG1pbiAvdHJhbnNmZX
      - YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg
      - Yml0c2FkbWluIC90cmFuc2Zlc
      - AGMAaAB1AG4AawBfAHMAaQB6AGUA
      - JABjAGgAdQBuAGsAXwBzAGkAegBlA
      - JGNodW5rX3Npem
      - QAYwBoAHUAbgBrAF8AcwBpAHoAZQ
      - RjaHVua19zaXpl
      - Y2h1bmtfc2l6Z
      - AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A
      - kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg
      - lPLkNvbXByZXNzaW9u
      - SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA
      - SU8uQ29tcHJlc3Npb2
      - Ty5Db21wcmVzc2lvb
      - AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ
      - kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA
      - lPLk1lbW9yeVN0cmVhb
      - SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A
      - SU8uTWVtb3J5U3RyZWFt
      - Ty5NZW1vcnlTdHJlYW
      - 4ARwBlAHQAQwBoAHUAbgBrA
      - 5HZXRDaHVua
      - AEcAZQB0AEMAaAB1AG4Aaw
      - LgBHAGUAdABDAGgAdQBuAGsA
      - LkdldENodW5r
      - R2V0Q2h1bm
      - AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A
      - QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA
      - RIUkVBRF9JTkZPNj
      - SFJFQURfSU5GTzY0
      - VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA
      - VEhSRUFEX0lORk82N
      - AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA
      - cmVhdGVSZW1vdGVUaHJlYW
      - MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA
      - NyZWF0ZVJlbW90ZVRocmVhZ
      - Q3JlYXRlUmVtb3RlVGhyZWFk
      - QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA
      - 0AZQBtAG0AbwB2AGUA
      - 1lbW1vdm
      - AGUAbQBtAG8AdgBlA
      - bQBlAG0AbQBvAHYAZQ
      - bWVtbW92Z
      - ZW1tb3Zl
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f26c6093-6f14-4b12-800f-0fcb46f5ffd0
    type: derived