Windows Security: Detect Obfuscated PowerShell Using COMPRESS/Compression Stream Components (Event ID 4697)

Alerts on service creation events where the ServiceFileName includes PowerShell obfuscation patterns tied to compression stream and ASCII encoding.

FreeUnreviewedSigmamediumv1

windows-security-detect-obfuscated-powershell-using-compress-compression-stream--7a922f1b

title: "Windows Security: Detect Obfuscated PowerShell Using COMPRESS/Compression Stream Components (Event ID 4697)"
id: 6aea9ee1-e2f0-4af2-9721-7ea9049c5aaa
related:
  - id: 175997c5-803c-4b08-8bb0-70b099f47595
    type: derived
  - id: 7a922f1b-2635-4d6c-91ef-af228b198ad3
    type: derived
status: test
description: This rule flags creation of a new service (Security event ID 4697) whose service binary path contains strings associated with PowerShell obfuscation using compression and text encoding components. Attackers may use these patterns to hide malicious PowerShell logic by leveraging .NET compression and stream reader/writer APIs. The detection relies on Windows Security auditing that records EID 4697 along with the ServiceFileName content.
references:
  - https://github.com/SigmaHQ/sigma/issues/1009
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml
author: Timur Zinniatullin, oscd.community, Huntrule Team
date: 2020-10-18
modified: 2022-11-29
tags:
  - attack.stealth
  - attack.t1027
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains|all:
      - new-object
      - text.encoding]::ascii
      - readtoend
    ServiceFileName|contains:
      - system.io.compression.deflatestream
      - system.io.streamreader
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1

What it detects

This rule flags creation of a new service (Security event ID 4697) whose service binary path contains strings associated with PowerShell obfuscation using compression and text encoding components. Attackers may use these patterns to hide malicious PowerShell logic by leveraging .NET compression and stream reader/writer APIs. The detection relies on Windows Security auditing that records EID 4697 along with the ServiceFileName content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.