Detectionhightest

PowerShell Base64 Encoded FromBase64String Cmdlet

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Sat Aug 24Updated Thu Apr 06fdb62a13-9a81-4e5c-a38f-ea93a16f6d7cwindows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        - CommandLine|base64offset|contains: '::FromBase64String'
        # UTF-16 LE
        - CommandLine|contains:
              - 'OgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcA'
              - 'oAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnA'
              - '6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZw'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

Internal Research

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0002 · Execution

Techniques

T1140 · Deobfuscate/Decode Files or Information

Sub-techniques

T1059.001 · PowerShell

Rule Metadata

Rule ID

fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c

Status

test

Level

high

Type

Detection

Created

Sat Aug 24

Modified

Thu Apr 06

Author

Florian Roth (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml

Raw Tags

attack.defense-evasionattack.t1140attack.executionattack.t1059.001

View on GitHub