PowerShell Shellcode Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects the execution of PowerShell scripts containing specific Base64 encoded shellcode signatures. The rule looks for the presence of 'OiCAAAAYInlM' or 'OiJAAAAYInlM' within the ScriptBlockText, which are known indicators of shellcode.