Detection rules › Sigma
Potential PowerShell Obfuscation Using Character Join
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
| Stealth | T1027 Obfuscated Files or Information |
Event coverage
| Provider | Event | Title |
|---|---|---|
| PowerShell | Event ID 4104 | Creating Scriptblock text (MessageNumber of MessageTotal). |
Rule body yaml
title: Potential PowerShell Obfuscation Using Character Join
id: e8314f79-564d-4f79-bc13-fbc0bf2660d8
related:
- id: 96cd126d-f970-49c4-848a-da3a09f55c55
type: derived
status: test
description: Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
references:
- Internal Research
author: Nasreddine Bencherchali (Nextron Systems)
date: 2023-01-09
tags:
- attack.execution
- attack.stealth
- attack.t1027
- attack.t1059.001
logsource:
product: windows
category: ps_script
definition: 'Requirements: Script Block Logging must be enabled'
detection:
selection:
# Example:
# Set-Alias -Name Y -Value (-join("Ne","w-O","bje","ct"))
# Set-Alias -Name X -Value (-join("Inv","oke","-","Exp","ression"))
ScriptBlockText|contains|all:
- '-Alias' # For both "New-Alias" and "Set-Alias"
- ' -Value (-join('
condition: selection
falsepositives:
- Unknown
level: low
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
ScriptBlockText|contains|all:
- '-Alias'
- ' -Value (-join('
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ScriptBlockText | match |
|