PowerShell Base64 Encoded FromBase64String Cmdlet Usage

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•12

Detects the usage of the PowerShell '::FromBase64String' cmdlet within a process command line, specifically looking for both direct string and UTF-16 LE encoded variations. This technique is commonly used by adversaries to deobfuscate or decode base64 encoded strings, often containing malicious payloads, within PowerShell scripts.