
title: Suspicious PowerShell Cmdline
author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community
date: 2020/10/11
description: Detects the PowerShell command lines with reversed strings
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\powershell.exe'
  SELECTION_3:
    CommandLine:
    - '*hctac*'
    - '*kearb*'
    - '*dnammoc*'
    - '*ekovn*'
    - '*eliFd*'
    - '*rahc*'
    - '*etirw*'
    - '*golon*'
    - '*tninon*'
    - '*eddih*'
    - '*tpircS*'
    - '*ssecorp*'
    - '*llehsrewop*'
    - '*esnopser*'
    - '*daolnwod*'
    - '*tneilCbeW*'
    - '*tneilc*'
    - '*ptth*'
    - '*elifotevas*'
    - '*46esab*'
    - '*htaPpmeTteG*'
    - '*tcejbO*'
    - '*maerts*'
    - '*hcaerof*'
    - '*ekovni*'
    - '*retupmoc*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3)
falsepositives:
- Unlikely
id: b6b49cd1-34d6-4ead-b1bf-176e9edba9a4
level: high
logsource:
  category: process_creation
  product: windows
references:
- https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66
status: experimental
tags:
- attack.defense_evasion
- attack.t1027
- attack.execution
- attack.t1059.001
ruletype: SIGMA
