Query: detect Detects base64 encoded strings used in hidden malicious PowerShell command lines in logs
Matching passage: Sigma rule: Detects base64 encoded strings used in hidden malicious PowerShell command lines. Logsource: windows / process_creation. Rule: title: Malicious Base64 Encoded PowerShell Keywords in Command Lines id: f26c6093-6f14-4b12-800f-0fcb46f5ffd0 status: test description: Detects base64 encoded strings used in hidden malicious PowerShell command lines references: - http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/ author: John Lambert (rule) date: 2019-01-16 modified: 2023-01-05 tags: - attack.execution - attack.t1059.001 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_hidden: CommandLine|contains: ' hidden ' selection_encoded: CommandLine|contains: - AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA - aXRzYWRtaW4gL3RyYW5zZmVy - IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA - JpdHNhZG1pbiAvdHJhbnNmZX - YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg - Yml0c2FkbWluIC90cmFuc2Zlc - AGMAaAB1AG4AawBfAHMAaQB6AGUA - JABjAGgAdQBuAGsAXwBzAGkAegBlA - JGNodW5rX3Npem - QAYwBoAHUAbgBrAF8AcwBpAHoAZQ - RjaHVua19zaXpl - Y2h1bmtfc2l6Z - AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A - kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg - lPLkNvbXByZXNzaW9u - SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA - SU8uQ29tcHJlc3Npb2 - Ty5Db21wcmVzc2lvb - AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ - kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA - lPLk1lbW9yeVN0cmVhb - SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A - SU8uTWVtb3J5U3RyZWFt - Ty5NZW1vcnlTdHJlYW - 4ARwBlAHQAQwBoAHUAbgBrA - 5HZXRDaHVua - AEcAZQB0AEMAaAB1AG4Aaw - LgBHAGUAdABDAGgAdQBuAGsA - LkdldENodW5r - R2V0Q2h1bm - AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A - QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA - RIUkVBRF9JTkZPNj - SFJFQURfSU5GTzY0 - VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA - VEhSRUFEX0lORk82N - AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA - cmVhdGVSZW1vdGVUaHJlYW - MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA - NyZWF0ZVJlbW90ZVRocmVhZ - Q3JlYXRlUmVtb3RlVGhyZWFk - QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA - 0AZQBtAG0AbwB2AGUA - 1lbW1vdm - AGUAbQBtAG8AdgBlA - bQBlAG0AbQBvAHYAZQ - bWVtbW92Z - ZW1tb3Zl condition: all of selection_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load mali. Logsource: windows / process_creation. Rule: title: Suspicious FromBase64String Usage On Gzip Archive - Process Creation id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f related: - id: df69cb1d-b891-4cd9-90c7-d617d90100ce type: similar status: test description: Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward. references: - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43 author: frack113 date: 2022-12-23 tags: - attack.command-and-control - attack.t1132.001 logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - FromBase64String - MemoryStream - H4sI condition: selection falsepositives: - Legitimate administrative script level: medium