Suspicious Encoded PowerShell Command Line

Title: Suspicious Encoded PowerShell Command Line
Status: test
Description:Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)
References:
  -https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
Author: Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community
Date: 2018-09-03
modified:2023-04-06
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'PowerShell.EXE'
      - 'pwsh.dll'
  selection_cli_enc:
    CommandLine|contains: ' -e'
  selection_cli_content:
    CommandLine|contains:
      -' JAB'
      -' SUVYI'
      -' SQBFAFgA'
      -' aQBlAHgA'
      -' aWV4I'
      -' IAA'
      -' IAB'
      -' UwB'
      -' cwB'

  selection_standalone:
    CommandLine|contains:
      -'.exe -ENCOD '
      -' BA^J e-'

  filter_optional_remote_signed:
    CommandLine|contains: ' -ExecutionPolicy remotesigned '
  condition:selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_*
Falsepositives:
Level: high