Suspicious PowerShell Script Decoding Base64 Gzip Archive

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•37

Detects attempts to decode a base64 encoded Gzip archive within a PowerShell script. This technique is often used by adversaries to load malicious content into memory, leveraging standard encoding for obfuscation and memory-resident execution.