Detection rules › Sigma
bXOR Operator Usage In PowerShell Command Line - PowerShell Classic
Detects powershell execution with that make use of to the bxor (Bitwise XOR). Attackers might use as an alternative obfuscation method to Base64 encoded commands. Investigate the CommandLine and process tree to determine if the activity is malicious.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
Event coverage
| Provider | Event |
|---|---|
| PowerShell | Event ID 400 |
Rule body yaml
title: bXOR Operator Usage In PowerShell Command Line - PowerShell Classic
id: 812837bb-b17f-45e9-8bd0-0ec35d2e3bd6
status: test
description: |
Detects powershell execution with that make use of to the bxor (Bitwise XOR).
Attackers might use as an alternative obfuscation method to Base64 encoded commands.
Investigate the CommandLine and process tree to determine if the activity is malicious.
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=46
- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
author: Teymur Kheirkhabarov, Harish Segar
date: 2020-06-29
modified: 2024-12-11
tags:
- attack.execution
- attack.t1059.001
- detection.threat-hunting
logsource:
product: windows
category: ps_classic_start
detection:
selection:
Data|contains|all:
- 'HostName=ConsoleHost'
- ' -bxor '
condition: selection
falsepositives:
- Unknown
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
Data|contains|all:
- 'HostName=ConsoleHost'
- ' -bxor '
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Data | match |
|