Query: detection rule: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
Matching passage: Sigma rule: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet). Logsource: windows / process_creation. Rule: title: Suspicious Encoded PowerShell Command Line id: ca2092a1-c273-4878-9b4b-0d60115bf5ea status: test description: Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet) references: - https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community date: 2018-09-03 modified: 2023-04-06 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_enc: CommandLine|contains: ' -e' selection_cli_content: CommandLine|contains: - ' JAB' - ' SUVYI' - ' SQBFAFgA' - ' aQBlAHgA' - ' aWV4I' - ' IAA' - ' IAB' - ' UwB' - ' cwB' selection_standalone: CommandLine|contains: - '.exe -ENCOD ' - ' BA^J e-' filter_optional_remote_signed: CommandLine|contains: ' -ExecutionPolicy remotesigned ' condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_* level: high
Near-miss passage: Sigma rule: Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the exe. Logsource: windows / process_creation. Rule: title: Potential Binary Impersonating Sysinternals Tools id: 7cce6fc8-a07f-4d84-a53e-96e1879843c9 status: test description: 'Detects binaries that use the same name as legitimate sysinternals tools to evade detection. This rule looks for the execution of binaries that are named similarly to Sysinternals tools. Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection. ' references: - https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite author: frack113, Swachchhanda Shrawan Poudel (Nextron Systems) date: 2021-12-20 modified: 2025-04-12 tags: - attack.execution - attack.stealth - attack.t1218 - attack.t1202 - attack.t1036.005 logsource: category: process_creation product: windows detection: selection_exe: Image|endswith: - \accesschk.exe - \accesschk64.exe - \AccessEnum.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADInsight.exe - \ADInsight64.exe - \adrestore.exe - \adrestore64.exe - \Autologon.exe - \Autologon64.exe - \Autoruns.exe - \Autoruns64.exe - \autorunsc.exe - \autorunsc64.exe - \Bginfo.exe - \Bginfo64.exe - \Cacheset.exe - \Cacheset64.exe - \Clockres.exe - \Clockres64.exe - \Contig.exe - \Contig64.exe - \Coreinfo.exe - \Coreinfo64.exe - \CPUSTRES.EXE - \CPUSTRES64.EXE - \ctrl2cap.exe - \Dbgview.exe - \dbgview64.exe - \Desktops.exe - \Desktops64.exe - \disk2vhd.exe - \disk2vhd64.exe - \diskext.exe - \diskext64.exe - \Diskmon.exe - \Diskmon64.exe - \DiskView.exe - \DiskView64.exe - \du.exe - \du64.exe - \efsdump.exe - \FindLinks.exe - \FindLinks64.exe - \handle.exe - \handle64.exe - \hex2dec.exe - \hex2dec64.exe - \junction.exe - \junction64.exe - \ldmdump.exe - \listdlls.exe - \listdlls64.exe - \livekd.exe - \livekd64.exe - \loadOrd.exe - \loadOrd64.exe - \loadOrdC.exe - \loadOrdC64.exe - \logonsessions.exe - \logonsessions64.exe - \movefile.exe - \movefile64.exe - \notmyfault.exe - \notmyfault64.exe - \notmyfaultc.exe - \notmyfaultc64.exe - \ntfsinfo.exe - \ntfsinfo64.exe - \pendmoves.exe - \pendmoves64.exe - \pipelist.exe - \pipelist64.exe - \portmon.exe - \procdump.exe - \procdump64.exe - \procexp.exe - \procexp64.exe - \Procmon.exe - \Procmon64.exe - \psExec.exe - \psExec64.exe - \psfile.exe - \psfile64.exe - \psGetsid.exe - \psGetsid64.exe - \psInfo.exe - \psInfo64.exe - \pskill.exe - \pskill64.exe - \pslist.exe - \pslist64.exe - \psLoggedon.exe - \psLoggedon64.exe - \psloglist.exe - \psloglist64.exe - \pspasswd.exe - \pspasswd64.exe - \psping.exe - \psping64.exe - \psService.exe - \p