Query: alert when Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Matching passage: Sigma rule: Detects Obfuscated Powershell via COMPRESS OBFUSCATION. Logsource: windows / ps_module. Rule: title: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module id: 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1 related: - id: 20e5497e-331c-4cd5-8d36-935f6e2a9a07 type: derived status: test description: Detects Obfuscated Powershell via COMPRESS OBFUSCATION references: - https://github.com/SigmaHQ/sigma/issues/1009 author: Timur Zinniatullin, oscd.community date: 2020-10-18 modified: 2022-11-29 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection_4103: Payload|contains|all: - new-object - text.encoding]::ascii Payload|contains: - system.io.compression.deflatestream - system.io.streamreader Payload|endswith: readtoend condition: selection_4103 falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.. Logsource: windows / process_creation. Rule: title: PowerShell Base64 Encoded WMI Classes id: 1816994b-42e1-4fb1-afd2-134d88184f71 related: - id: 47688f1b-9f51-4656-b013-3cc49a166a36 type: obsolete status: test description: Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc. references: - https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar author: Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) date: 2023-01-30 tags: - attack.execution - attack.stealth - attack.t1059.001 - attack.t1027 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \powershell.exe - \pwsh.exe - OriginalFileName: - PowerShell.EXE - pwsh.dll selection_cli_shadowcopy: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBoAGEAZABvAHcAYwBvAHAAeQ - cAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkA - XAGkAbgAzADIAXwBTAGgAYQBkAG8AdwBjAG8AcAB5A - V2luMzJfU2hhZG93Y29we - dpbjMyX1NoYWRvd2NvcH - XaW4zMl9TaGFkb3djb3B5 selection_cli_scheduledJob: CommandLine|contains: - VwBpAG4AMwAyAF8AUwBjAGgAZQBkAHUAbABlAGQASgBvAGIA - cAaQBuADMAMgBfAFMAYwBoAGUAZAB1AGwAZQBkAEoAbwBiA - XAGkAbgAzADIAXwBTAGMAaABlAGQAdQBsAGUAZABKAG8AYg - V2luMzJfU2NoZWR1bGVkSm9i - dpbjMyX1NjaGVkdWxlZEpvY - XaW4zMl9TY2hlZHVsZWRKb2 selection_cli_process: CommandLine|contains: - VwBpAG4AMwAyAF8AUAByAG8AYwBlAHMAcw - cAaQBuADMAMgBfAFAAcgBvAGMAZQBzAHMA - XAGkAbgAzADIAXwBQAHIAbwBjAGUAcwBzA - V2luMzJfUHJvY2Vzc - dpbjMyX1Byb2Nlc3 - XaW4zMl9Qcm9jZXNz selection_cli_useraccount: CommandLine|contains: - VwBpAG4AMwAyAF8AVQBzAGUAcgBBAGMAYwBvAHUAbgB0A - cAaQBuADMAMgBfAFUAcwBlAHIAQQBjAGMAbwB1AG4AdA - XAGkAbgAzADIAXwBVAHMAZQByAEEAYwBjAG8AdQBuAHQA - V2luMzJfVXNlckFjY291bn - dpbjMyX1VzZXJBY2NvdW50 - XaW4zMl9Vc2VyQWNjb3Vud selection_cli_loggedonuser: CommandLine|contains: - VwBpAG4AMwAyAF8ATABvAGcAZwBlAGQATwBuAFUAcwBlAHIA - cAaQBuADMAMgBfAEwAbwBnAGcAZQBkAE8AbgBVAHMAZQByA - XAGkAbgAzADIAXwBMAG8AZwBnAGUAZABPAG4AVQBzAGUAcg - V2luMzJfTG9nZ2VkT25Vc2Vy - dpbjMyX0xvZ2dlZE9uVXNlc - XaW4zMl9Mb2dnZWRPblVzZX condition: selection_img and 1 of selection_cli_* falsepositives: - Unknown level: high