Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Severity: high
Author: frack113, Florian Roth (Nextron Systems), Josh Nickels
Source: upstream

Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1027` Obfuscated Files or Information

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `all of selection_img`

or:
Image|endswith: '\cmd.exe'
Image|endswith: '\cscript.exe'
Image|endswith: '\powershell.exe'
Image|endswith: '\powershell_ise.exe'
Image|endswith: '\pwsh.exe'
Image|endswith: '\wscript.exe'
OriginalFileName: [Cmd.EXE, PowerShell.EXE, PowerShell_ISE.EXE, cscript.exe, pwsh.dll, wscript.exe]

Stage 2: `all of selection_special_chars`

or:
CommandLine|contains: ' '
CommandLine|contains: '®'
CommandLine|contains: '¯'
CommandLine|contains: '¶'
CommandLine|contains: 'ˢ'
CommandLine|contains: 'ˣ'
CommandLine|contains: '˪'
CommandLine|contains: '—'
CommandLine|contains: '―'
CommandLine|contains: '⁄'
CommandLine|contains: '∕'
CommandLine|contains: '⠀'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`®` `¯` `¶` `ˢ` `ˣ` `˪` `—` `―` `⁄` `∕` `⠀`
`Image`	ends_with	`\cmd.exe` corpus 92 (sigma 92) `\cscript.exe` corpus 64 (sigma 64) `\powershell.exe` corpus 143 (sigma 143) `\powershell_ise.exe` corpus 27 (sigma 27) `\pwsh.exe` corpus 140 (sigma 140) `\wscript.exe` corpus 64 (sigma 64)
`OriginalFileName`	eq	`Cmd.EXE` corpus 2 (sigma 2) `PowerShell.EXE` corpus 64 (sigma 60, splunk 4) `PowerShell_ISE.EXE` corpus 6 (sigma 6) `cscript.exe` corpus 15 (sigma 15) `pwsh.dll` corpus 72 (sigma 68, splunk 4) `wscript.exe` corpus 15 (sigma 15)