Encoded PowerShell payload deployed (PowerShell)

title: Encoded PowerShell payload deployed (PowerShell)
description: Detects scenarios where an attacker deployed a service pointing to a hidden and encoded PowerShell payload.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1059.001-PowerShell
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
- https://www.huntress.com/blog/from-powershell-to-payload-an-analysis-of-weaponized-malware
- https://www.huntress.com/blog/malware-deep-dive-examining-a-powershell-payload
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.md
- https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-in-october-2019
- https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
- https://unit42.paloaltonetworks.com/threat-brief-OWASSRF/
tags:
- attack.execution
- attack.t1059.001
- attack.defense_evasion
- attack.t1027
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - 'FromBase64String'
      - 'IO.StreamReader'
      - 'IO.Compression.'

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - 'FromBase64String'
      - 'IO.StreamReader'
      - 'IO.Compression.'

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - 'FromBase64String'
      - 'IO.StreamReader'
      - 'IO.Compression.'

  condition: 1 of selection*
falsepositives:
- Unknown
level: high

#- 'FromBase64String'
#- 'IO.StreamReader'
#- 'IO.Compression.'
#- '[System.Convert]::'
#- '[Convert]'
#- 'System.Diagnostics.Process'