Sigma rule: Suspicious Encoded PowerShell Command Line

Rule

Title

Suspicious Encoded PowerShell Command Line

Status

test

Level

high

Author

Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community

Date

2018-09-03

Modified

2023-04-06

File

rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Log source

product

windows

category

process_creation

Detection

selection_img:
    - Image|endswith:
          - '\powershell.exe'
          - '\pwsh.exe'
    - OriginalFileName:
          - 'PowerShell.EXE'
          - 'pwsh.dll'
selection_cli_enc:
    CommandLine|contains: ' -e' # covers -en and -enc
selection_cli_content:
    CommandLine|contains:
        - ' JAB'
        - ' SUVYI'
        - ' SQBFAFgA'
        - ' aQBlAHgA'
        - ' aWV4I'
        - ' IAA'
        - ' IAB'
        - ' UwB'
        - ' cwB'
selection_standalone:
    CommandLine|contains:
        - '.exe -ENCOD '
        - ' BA^J e-' # Reversed
filter_optional_remote_signed:
    CommandLine|contains: ' -ExecutionPolicy remotesigned '
condition: selection_img and (all of selection_cli_* or selection_standalone) and not 1 of filter_optional_*

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml