Sigma rule: PowerShell Execution With Potential Decryption Capabilities

Rule

Title

PowerShell Execution With Potential Decryption Capabilities

Status

test

Level

high

Author

X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

Date

2023-06-30

Modified

2023-12-05

File

rules/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects PowerShell commands that decrypt an ".LNK" "file to drop the next stage of the malware.

Log source

product

windows

category

process_creation

Detection

selection_img:
    Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
    OriginalFileName:
        - 'PowerShell.EXE'
        - 'pwsh.dll'
selection_cli_dir:
    CommandLine|contains:
        - "Get-ChildItem "
        - "dir "
        - "gci "
        - "ls "
selection_cli_gc:
    CommandLine|contains:
        - "Get-Content "
        - "gc "
        - 'cat '
        - 'type '
        - 'ReadAllBytes'
selection_cli_specific:
    - CommandLine|contains|all:
          - ' ^| '
          - '\*.lnk'
          - '-Recurse'
          - '-Skip '
    - CommandLine|contains|all:
          - ' -ExpandProperty '
          - '\*.lnk'
          - 'WriteAllBytes'
          - ' .length '
condition: all of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution

References

• https://research.checkpoint.com/2023/chinese-threat-actors-targeting-europe-in-smugx-campaign/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_decrypt_pattern.yml