PowerShell ShellCode

Title: PowerShell ShellCode
Status: test
Description:Detects Base64 encoded Shellcode
References:
  -https://twitter.com/cyb3rops/status/1063072865992523776
Author: David Ledbetter (shellcode), Florian Roth (Nextron Systems)
Date: 2018-11-17
modified:2024-01-25
Tags:

• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'
• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains:
      -'OiCAAAAYInlM'
      -'OiJAAAAYInlM'

  condition:selection
Falsepositives:
  -Unknown
Level: high