Suspicious Encoded PowerShell Command Line

Severity: high
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community
Source: upstream

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection_img`

or:
Image|endswith: '\powershell.exe'
Image|endswith: '\pwsh.exe'
OriginalFileName: PowerShell.EXE
OriginalFileName: pwsh.dll

Stage 2: `all of selection_cli_enc`

CommandLine|contains: ' -e'

Stage 3: `all of selection_cli_content`

or:
CommandLine|contains: ' IAA'
CommandLine|contains: ' IAB'
CommandLine|contains: ' JAB'
CommandLine|contains: ' SQBFAFgA'
CommandLine|contains: ' SUVYI'
CommandLine|contains: ' UwB'
CommandLine|contains: ' aQBlAHgA'
CommandLine|contains: ' aWV4I'
CommandLine|contains: ' cwB'

Stage 4: `selection_standalone`

or:
CommandLine|contains: ' BA^J e-'
CommandLine|contains: '.exe -ENCOD '

Stage 5: `not 1 of filter_optional_remote_signed`

CommandLine|contains: ' -ExecutionPolicy remotesigned '

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`-ExecutionPolicy remotesigned` `-e` corpus 4 (sigma 4) `BA^J e-` `IAA` `IAB` corpus 2 (sigma 2) `JAB` corpus 2 (sigma 2) `SQBFAFgA` corpus 2 (sigma 2) `SUVYI` corpus 2 (sigma 2) `UwB` `aQBlAHgA` corpus 2 (sigma 2) `aWV4I` corpus 2 (sigma 2) `cwB` `.exe -ENCOD`
`Image`	ends_with	`\powershell.exe` corpus 143 (sigma 143) `\pwsh.exe` corpus 140 (sigma 140)
`OriginalFileName`	eq	`PowerShell.EXE` corpus 64 (sigma 60, splunk 4) `pwsh.dll` corpus 72 (sigma 68, splunk 4)

Suspicious Encoded PowerShell Command Line

MITRE ATT&CK coverage

Event coverage

Stages and Predicates

Stage 1: selection_img

Stage 2: all of selection_cli_enc

Stage 3: all of selection_cli_content