
title: Malicious Base64 Encoded PowerShell Keywords in Command Lines
author: John Lambert (rule)
date: 2019/01/16
description: Detects base64 encoded strings used in hidden malicious PowerShell command
  lines
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image: '*\powershell.exe'
  SELECTION_3:
    CommandLine: '* hidden *'
  SELECTION_4:
    CommandLine:
    - '*AGkAdABzAGEAZABtAGkAbgAgAC8AdAByAGEAbgBzAGYAZQByA*'
    - '*aXRzYWRtaW4gL3RyYW5zZmVy*'
    - '*IAaQB0AHMAYQBkAG0AaQBuACAALwB0AHIAYQBuAHMAZgBlAHIA*'
    - '*JpdHNhZG1pbiAvdHJhbnNmZX*'
    - '*YgBpAHQAcwBhAGQAbQBpAG4AIAAvAHQAcgBhAG4AcwBmAGUAcg*'
    - '*Yml0c2FkbWluIC90cmFuc2Zlc*'
    - '*AGMAaAB1AG4AawBfAHMAaQB6AGUA*'
    - '*JABjAGgAdQBuAGsAXwBzAGkAegBlA*'
    - '*JGNodW5rX3Npem*'
    - '*QAYwBoAHUAbgBrAF8AcwBpAHoAZQ*'
    - '*RjaHVua19zaXpl*'
    - '*Y2h1bmtfc2l6Z*'
    - '*AE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4A*'
    - '*kATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8Abg*'
    - '*lPLkNvbXByZXNzaW9u*'
    - '*SQBPAC4AQwBvAG0AcAByAGUAcwBzAGkAbwBuA*'
    - '*SU8uQ29tcHJlc3Npb2*'
    - '*Ty5Db21wcmVzc2lvb*'
    - '*AE8ALgBNAGUAbQBvAHIAeQBTAHQAcgBlAGEAbQ*'
    - '*kATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtA*'
    - '*lPLk1lbW9yeVN0cmVhb*'
    - '*SQBPAC4ATQBlAG0AbwByAHkAUwB0AHIAZQBhAG0A*'
    - '*SU8uTWVtb3J5U3RyZWFt*'
    - '*Ty5NZW1vcnlTdHJlYW*'
    - '*4ARwBlAHQAQwBoAHUAbgBrA*'
    - '*5HZXRDaHVua*'
    - '*AEcAZQB0AEMAaAB1AG4Aaw*'
    - '*LgBHAGUAdABDAGgAdQBuAGsA*'
    - '*LkdldENodW5r*'
    - '*R2V0Q2h1bm*'
    - '*AEgAUgBFAEEARABfAEkATgBGAE8ANgA0A*'
    - '*QASABSAEUAQQBEAF8ASQBOAEYATwA2ADQA*'
    - '*RIUkVBRF9JTkZPNj*'
    - '*SFJFQURfSU5GTzY0*'
    - '*VABIAFIARQBBAEQAXwBJAE4ARgBPADYANA*'
    - '*VEhSRUFEX0lORk82N*'
    - '*AHIAZQBhAHQAZQBSAGUAbQBvAHQAZQBUAGgAcgBlAGEAZA*'
    - '*cmVhdGVSZW1vdGVUaHJlYW*'
    - '*MAcgBlAGEAdABlAFIAZQBtAG8AdABlAFQAaAByAGUAYQBkA*'
    - '*NyZWF0ZVJlbW90ZVRocmVhZ*'
    - '*Q3JlYXRlUmVtb3RlVGhyZWFk*'
    - '*QwByAGUAYQB0AGUAUgBlAG0AbwB0AGUAVABoAHIAZQBhAGQA*'
    - '*0AZQBtAG0AbwB2AGUA*'
    - '*1lbW1vdm*'
    - '*AGUAbQBtAG8AdgBlA*'
    - '*bQBlAG0AbQBvAHYAZQ*'
    - '*bWVtbW92Z*'
    - '*ZW1tb3Zl*'
  condition: (SELECTION_1 and SELECTION_2 and SELECTION_3 and SELECTION_4)
falsepositives:
- Penetration tests
id: f26c6093-6f14-4b12-800f-0fcb46f5ffd0
level: high
logsource:
  category: process_creation
  product: windows
references:
- http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/
status: experimental
tags:
- attack.execution
- attack.t1059.001
- attack.t1086
ruletype: SIGMA
