Potential PowerShell Obfuscation Via WCHAR/CHAR
A Sigma rule for process creation on Windows, by Florian Roth (Nextron Systems).
high 2 ATT&CK techniques 4 everyday examples trip it
What it looks for
detection:
selection:
CommandLine|contains:
- '[char]0x'
- '(WCHAR)0x'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Florian Roth (Nextron Systems), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Set foreground and background colors on the page for Set-PSReadLineOption
Set-PSReadLineOption -Colors @{ "Comment"="$([char]0x1b)[32;47m" }IdentifySet color values for multiple types on the page for Set-PSReadLineOption
Set-PSReadLineOption -Colors @{
# Use a ConsoleColor enum
"Error" = [ConsoleColor]::DarkRed
# 24 bit color escape sequence
"String" = "$([char]0x1b)[38;5;100m"
# RGB value
"Command" = "#8181f7"
}IdentifyUse ViModeChangeHandler to display Vi mode changes on the page for Set-PSReadLineOption
function OnViModeChange {
if ($args[0] -eq 'Command') {
# Set the cursor to a blinking block.
Write-Host -NoNewline "$([char]0x1b)[1 q"
} else {
# Set the cursor to a blinking line.
Write-Host -NoNewline "$([char]0x1b)[5 q"
}
}
Set-PSReadLineOption -ViModeIndicator Script -ViModeChangeHandler $Function:OnViModeChangeIdentifyAdd items to a property value on the page for Update-List
class Cards {
[System.Collections.Generic.List[string]]$Cards
[string]$Name
Cards([string]$_name) {
$this.Name = $_name
$this.Cards = [System.Collections.Generic.List[string]]::new()
}
NewDeck() {
$_suits = [char]0x2663,[char]0x2666,[char]0x2665,[char]0x2660
$_values = 'A',2,3,4,5,6,7,8,9,10,'J','Q','K'
$_deck = foreach ($s in $_suits){ foreach ($v in $_values){ "$v$s"} }
$this | Update-List -Property Cards -Add $_deck | Out-Null
}
Show() {
Write-Host
Write-Host $this.Name ": " $this.Cards[0..12]
if ($this.Cards.Count -gt 13) {
Write-Host (' ' * ($this.Name.Length+3)) $this.Cards[13..25]
}
if ($this.Cards.Count -gt 26) {
Write-Host (' ' * ($this.Name.Length+3)) $this.Cards[26..38]
}
if ($this.Cards.Count -gt 39) {
Write-Host (' ' * ($this.Name.Length+3)) $this.Cards[39..51]
}
}
Shuffle() { $this.Cards = Get-Random -InputObject $this.Cards -Count 52 }
Sort() { $this.Cards.Sort() }
}Identify