Suspicious FromBase64String Usage On Gzip Archive - Process Creation
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward. The detection relies on the presence of 'FromBase64String' for decoding, 'MemoryStream' for in-memory operations, and 'H4sI' which is a common magic string for Gzip compressed data.
Sigma
