Potential Encoded PowerShell Patterns In CommandLine
A Sigma rule for process creation on Windows, by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton.
low 2 ATT&CK techniques 2 programs it names 2 everyday examples trip it
What it looks for
detection:
selection_gen_1:
CommandLine|contains|all:
- 'char'
- 'join'
selection_gen_2:
CommandLine|contains|all:
- 'split'
- 'join'
selection_img:
- Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- OriginalFileName:
- 'PowerShell.EXE'
- 'pwsh.dll'
selection_to_1:
CommandLine|contains:
- 'ToInt'
- 'ToDecimal'
- 'ToByte'
- 'ToUint'
- 'ToSingle'
- 'ToSByte'
selection_to_2:
CommandLine|contains:
- 'ToChar'
- 'ToString'
- 'String'
condition: selection_img and (all of selection_to_* or 1 of selection_gen_*)
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Encrypt an exported credential object on the page for Export-Clixml
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential | Export-Clixml $Credxmlpath
$Credxmlpath = Join-Path (Split-Path $PROFILE) TestScript.ps1.credential
$Credential = Import-Clixml $CredxmlpathIdentifyNormalizing input on the page for Read-Host
$prompt = @(
'List the cities you want weather information for.'
'When specifying multiple cities, separate them with a semi-colon, like:'
"'New York; Osan; Koforidua'"
) -join ' '
$cities = Read-Host $prompt
"Input cities string: nt'$cities'"
$splitCities = $cities -split ';'
"Split cities array:"
$splitCities | ForEach-Object -Process { "t'$_'" }
$normalizedCities = $splitCities | ForEach-Object -Process { $_.Trim() }
"Normalized split cities array:"
$normalizedCities | ForEach-Object -Process { "t'$_'" }Identify