Suspicious PowerShell Encoded Command Patterns

Title: Suspicious PowerShell Encoded Command Patterns
Status: test
Description:Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains
References:
  -https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/
Author: Florian Roth (Nextron Systems)
Date: 2022-05-24
modified:2023-01-05
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    - OriginalFileName:
      - 'PowerShell.Exe'
      - 'pwsh.dll'
  selection_flags:
    CommandLine|contains:
      -' -e '
      -' -en '
      -' -enc '
      -' -enco'

  selection_encoded:
    CommandLine|contains:
      -' JAB'
      -' SUVYI'
      -' SQBFAFgA'
      -' aWV4I'
      -' IAB'
      -' PAA'
      -' aQBlAHgA'

  filter_gcworker:
    ParentImage|contains:
      -'C:\Packages\Plugins\Microsoft.GuestConfiguration.ConfigurationforWindows\'
      -'\gc_worker.exe'

  condition:all of selection_* and not 1 of filter_*
Falsepositives:
  -Other tools that work with encoded scripts in the command line instead of script files
Level: high