Malicious Base64 Encoded PowerShell Keywords in Command Lines
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects base64 encoded strings used in hidden malicious PowerShell command lines
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\powershell.exe,\pwsh.exe" OR ORIGINALFILENAME = "PowerShell.EXE,pwsh.dll") AND COMMANDLINE contains " hidden " AND (COMMANDLINE contains "AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA,aXRzYWRtaW4gL3RyYW5zZmVy,IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA,JpdHNhZG1pbiAvdHJhbnNmZX,YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg,Yml0c2FkbWluIC90cmFuc2Zlc,AGMAaAB1AG4AawBfAHMAaQB6AGUA,JABjAGgAdQBuAGsAXwBzAGkAegBlA,JGNodW5rX3Npem,QAYwBoAHUAbgBrAF8AcwBpAHoAZQ,RjaHVua19zaXpl,Y2h1bmtfc2l6Z,AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A,kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg,lPLkNvbXByZXNzaW9u,SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA,SU8uQ29tcHJlc3Npb2,Ty5Db21wcmVzc2lvb,AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ,kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA,lPLk1lbW9yeVN0cmVhb,SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A,SU8uTWVtb3J5U3RyZWFt,Ty5NZW1vcnlTdHJlYW" OR COMMANDLINE contains "4ARwBlAHQAQwBoAHUAbgBrA,5HZXRDaHVua,AEcAZQB0AEMAaAB1AG4Aaw,LgBHAGUAdABDAGgAdQBuAGsA,LkdldENodW5r,R2V0Q2h1bm,AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A,QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA,RIUkVBRF9JTkZPNj,SFJFQURfSU5GTzY0,VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA,VEhSRUFEX0lORk82N,AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA,cmVhdGVSZW1vdGVUaHJlYW,MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA,NyZWF0ZVJlbW90ZVRocmVhZ,Q3JlYXRlUmVtb3RlVGhyZWFk,QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA,0AZQBtAG0AbwB2AGUA,1lbW1vdm,AGUAbQBtAG8AdgBlA,bQBlAG0AbQBvAHYAZQ,bWVtbW92Z,ZW1tb3Zl") select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
John Lambert (rule)
