Potential Encoded PowerShell Patterns In CommandLine

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

Detects specific combinations of encoding methods in PowerShell via the commandline, looking for patterns indicative of obfuscation techniques used to hide malicious PowerShell commands. This rule specifically targets the use of 'ToInt', 'ToDecimal', 'ToByte', 'ToUint', 'ToSingle', 'ToSByte', 'ToChar', 'ToString', 'String' in conjunction with PowerShell executables, or combinations of 'char' and 'join', or 'split' and 'join' in the command line.