Suspicious Encoded PowerShell Command Line

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community
Source: github.com/SigmaHQ/sigma

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Suspicious Encoded PowerShell Command Line
id: ca2092a1-c273-4878-9b4b-0d60115bf5ea
status: test
description: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
references:
    - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community
date: 2018-09-03
modified: 2023-04-06
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'PowerShell.EXE'
              - 'pwsh.dll'
    selection_cli_enc:
        CommandLine|contains: ' -e' # covers -en and -enc
    selection_cli_content:
        CommandLine|contains:
            - ' JAB'
            - ' SUVYI'
            - ' SQBFAFgA'
            - ' aQBlAHgA'
            - ' aWV4I'
            - ' IAA'
            - ' IAB'
            - ' UwB'
            - ' cwB'
    selection_standalone:
        CommandLine|contains:
            - '.exe -ENCOD '
            - ' BA^J e-' # Reversed
    filter_optional_remote_signed:
        CommandLine|contains: ' -ExecutionPolicy remotesigned '
    condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_*
level: high

Stages and Predicates

Stage 0: `condition`

selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'

Stage 2: `selection_cli_enc`

selection_cli_enc:
    CommandLine|contains: ' -e'

Stage 3: `selection_cli_content`

selection_cli_content:
    CommandLine|contains:
        - ' JAB'
        - ' SUVYI'
        - ' SQBFAFgA'
        - ' aQBlAHgA'
        - ' aWV4I'
        - ' IAA'
        - ' IAB'
        - ' UwB'
        - ' cwB'

Stage 4: `selection_standalone`

selection_standalone:
    CommandLine|contains:
        - '.exe -ENCOD '
        - ' BA^J e-'

Stage 5: `not filter_optional_remote_signed`

filter_optional_remote_signed:
    CommandLine|contains: ' -ExecutionPolicy remotesigned '

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`-ExecutionPolicy remotesigned`	`excludes:CommandLine` `field:"CommandLine" value:" -ExecutionPolicy remotesigned "`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`-e` corpus 6 (sigma 5, splunk 1) `BA^J e-` `IAA` `IAB` corpus 2 (sigma 2) `JAB` corpus 2 (sigma 2) `SQBFAFgA` corpus 2 (sigma 2) `SUVYI` corpus 2 (sigma 2) `UwB` `aQBlAHgA` corpus 2 (sigma 2) `aWV4I` corpus 2 (sigma 2) `cwB` `.exe -ENCOD`	`field:"CommandLine" kind:match`
`Image`	ends_with	`\powershell.exe` corpus 179 (sigma 178, kusto 1) `\pwsh.exe` corpus 165 (sigma 164, kusto 1)	`field:"Image" kind:ends_with`
`OriginalFileName`	eq	`PowerShell.EXE` corpus 138 (sigma 84, splunk 30, elastic 24) `pwsh.dll` corpus 112 (sigma 79, splunk 30, elastic 3)	`field:"OriginalFileName" kind:eq`

Suspicious Encoded PowerShell Command Line

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli_enc

Stage 3: selection_cli_content

Stage 4: selection_standalone

Stage 5: not filter_optional_remote_signed

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli_enc`

Stage 3: `selection_cli_content`

Stage 4: `selection_standalone`

Stage 5: `not filter_optional_remote_signed`