Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings

Alerts on PowerShell executions where the command line contains suspicious truncated parameter substrings (e.g., windowstyle, NoProfile, encoded/exec policy, bypass).

FreeUnreviewedSigmahighv1

windows-process-creation-suspicious-powershell-argument-obfuscation-via-truncate-36210e0d

title: "Windows Process Creation: Suspicious PowerShell Argument Obfuscation via Truncated Substrings"
id: f5812fe6-8d7f-49f1-ab1f-bc250aeb49f2
status: test
description: This rule flags Windows process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains truncated or partial substrings related to common flags and options. Attackers often obfuscate PowerShell parameters to evade straightforward detections, making these substring patterns useful for catching malformed or deliberately altered argument sequences. It relies on process creation telemetry that provides the process image path/name and the full command line string.
references:
  - http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml
author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix), Huntrule Team
date: 2019-01-16
modified: 2022-07-14
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - \powershell.exe
      - \pwsh.exe
    CommandLine|contains:
      - " -windowstyle h "
      - " -windowstyl h"
      - " -windowsty h"
      - " -windowst h"
      - " -windows h"
      - " -windo h"
      - " -wind h"
      - " -win h"
      - " -wi h"
      - " -win h "
      - " -win hi "
      - " -win hid "
      - " -win hidd "
      - " -win hidde "
      - " -NoPr "
      - " -NoPro "
      - " -NoProf "
      - " -NoProfi "
      - " -NoProfil "
      - " -nonin "
      - " -nonint "
      - " -noninte "
      - " -noninter "
      - " -nonintera "
      - " -noninterac "
      - " -noninteract "
      - " -noninteracti "
      - " -noninteractiv "
      - " -ec "
      - " -encodedComman "
      - " -encodedComma "
      - " -encodedComm "
      - " -encodedCom "
      - " -encodedCo "
      - " -encodedC "
      - " -encoded "
      - " -encode "
      - " -encod "
      - " -enco "
      - " -en "
      - " -executionpolic "
      - " -executionpoli "
      - " -executionpol "
      - " -executionpo "
      - " -executionp "
      - " -execution bypass"
      - " -executio bypass"
      - " -executi bypass"
      - " -execut bypass"
      - " -execu bypass"
      - " -exec bypass"
      - " -exe bypass"
      - " -ex bypass"
      - " -ep bypass"
      - " /windowstyle h "
      - " /windowstyl h"
      - " /windowsty h"
      - " /windowst h"
      - " /windows h"
      - " /windo h"
      - " /wind h"
      - " /win h"
      - " /wi h"
      - " /win h "
      - " /win hi "
      - " /win hid "
      - " /win hidd "
      - " /win hidde "
      - " /NoPr "
      - " /NoPro "
      - " /NoProf "
      - " /NoProfi "
      - " /NoProfil "
      - " /nonin "
      - " /nonint "
      - " /noninte "
      - " /noninter "
      - " /nonintera "
      - " /noninterac "
      - " /noninteract "
      - " /noninteracti "
      - " /noninteractiv "
      - " /ec "
      - " /encodedComman "
      - " /encodedComma "
      - " /encodedComm "
      - " /encodedCom "
      - " /encodedCo "
      - " /encodedC "
      - " /encoded "
      - " /encode "
      - " /encod "
      - " /enco "
      - " /en "
      - " /executionpolic "
      - " /executionpoli "
      - " /executionpol "
      - " /executionpo "
      - " /executionp "
      - " /execution bypass"
      - " /executio bypass"
      - " /executi bypass"
      - " /execut bypass"
      - " /execu bypass"
      - " /exec bypass"
      - " /exe bypass"
      - " /ex bypass"
      - " /ep bypass"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 36210e0d-5b19-485d-a087-c096088885f0
    type: derived

What it detects

This rule flags Windows process executions of PowerShell (powershell.exe or pwsh.exe) where the command line contains truncated or partial substrings related to common flags and options. Attackers often obfuscate PowerShell parameters to evade straightforward detections, making these substring patterns useful for catching malformed or deliberately altered argument sequences. It relies on process creation telemetry that provides the process image path/name and the full command line string.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.