Detection rules › Sigma
Encoded PowerShell payload deployed via process execution
Detects scenarios where an attacker deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.003 Command and Scripting Interpreter: Windows Command Shell |
| Stealth | T1027 Obfuscated Files or Information |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: Encoded PowerShell payload deployed via process execution
description: Detects scenarios where an attacker deployed an encoded PowerShell payload via a process execution. Some parameters are commented in case you would like to reduce false positives or make the rule more precise.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0002-Execution/T1059.001-PowerShell
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
- https://www.huntress.com/blog/from-powershell-to-payload-an-analysis-of-weaponized-malware
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.md
- https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-in-october-2019
- https://www.crowdstrike.com/blog/getting-the-bacon-from-cobalt-strike-beacon/
- https://research.splunk.com/endpoint/8acbc04c-c882-11eb-b060-acde48001122/
tags:
- attack.execution
- attack.t1059.003
- attack.defense_evasion
- attack.t1027
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection:
NewProcessName|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe # PowerShell v6
- \powershell_ise.exe # Development GUI
CommandLine|contains:
- '[System.Convert]::'
- 'FromBase64String'
- 'IO.StreamReader'
- 'IO.Compression.'
condition: selection
falsepositives:
- none
level: high
#Payload sample:
#C:\Windows\system32\cmd.exe /b /c start /b /min powershell.exe -nop -w hidden -noni -c "if([IntPtr]::Size -eq 4){$b='powershell.exe'}else{$b=$env:windir+'\syswow64\WindowsPowerShell\v1.0\powershell.exe'};$s=New-Object System.Diagnostics.ProcessStartInfo;$s.FileName=$b;$s.Arguments='-noni -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String(''H4sIA3+DTnHlctdCgAA''))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))';$s.UseShellExecute=$false;$s.RedirectStandardOutput=$true;$s.WindowStyle='Hidden';$s.CreateNoWindow=$true;$p=[System.Diagnostics.Process]::Start($s);"
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
NewProcessName|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \powershell_ise.exe
CommandLine|contains:
- '[System.Convert]::'
- 'FromBase64String'
- 'IO.StreamReader'
- 'IO.Compression.'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
NewProcessName | ends_with |
|