PowerShell Base64 Encoded IEX Cmdlet

Title: PowerShell Base64 Encoded IEX Cmdlet
Status: test
Description:Detects usage of a base64 encoded "IEX" cmdlet in a process command line
References:
  -Internal Research
Author: Florian Roth (Nextron Systems)
Date: 2019-08-23
modified:2023-04-06
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    - CommandLine|base64offset|contains:
      - 'IEX (['
      - 'iex (['
      - 'iex (New'
      - 'IEX (New'
      - 'IEX(['
      - 'iex(['
      - 'iex(New'
      - 'IEX(New'
      - 'IEX((''
      - 'iex((''
    - CommandLine|contains:
      - 'SQBFAFgAIAAoAFsA'
      - 'kARQBYACAAKABbA'
      - 'JAEUAWAAgACgAWw'
      - 'aQBlAHgAIAAoAFsA'
      - 'kAZQB4ACAAKABbA'
      - 'pAGUAeAAgACgAWw'
      - 'aQBlAHgAIAAoAE4AZQB3A'
      - 'kAZQB4ACAAKABOAGUAdw'
      - 'pAGUAeAAgACgATgBlAHcA'
      - 'SQBFAFgAIAAoAE4AZQB3A'
      - 'kARQBYACAAKABOAGUAdw'
      - 'JAEUAWAAgACgATgBlAHcA'
  condition:selection
Falsepositives:
  -Unknown
Level: high