PowerShell Script Block Logging: Deobfuscation and Assembly Loading
This rule detects PowerShell script blocks that exhibit characteristics of highly obfuscated and potentially malicious code. Specifically, it looks for the combination of: 1. Compression techniques (using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream'). 2. Base64 decoding (using 'FromBase64String' or 'Convert::FromBase64'). 3. Assembly loading via reflection (using 'Reflection.Assembly' or 'Assembly]::Load'). This combination is frequently used by attackers to hide malicious payloads, decompress them, decode them, and then load them into memory for execution, bypassing traditional file-based detection.
Splunk (SPL)
