PowerShell Base64 Encoded IEX Cmdlet

Hunt Hypothesis

Detects usage of a base64 encoded “IEX” cmdlet in a process command line

Detection Rule

Sigma (Original)

title: PowerShell Base64 Encoded IEX Cmdlet
id: 88f680b8-070e-402c-ae11-d2914f2257f1
status: test
description: Detects usage of a base64 encoded "IEX" cmdlet in a process command line
references:
    - Internal Research
author: Florian Roth (Nextron Systems)
date: 2019-08-23
modified: 2023-04-06
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - CommandLine|base64offset|contains:
              - 'IEX (['
              - 'iex (['
              - 'iex (New'
              - 'IEX (New'
              - 'IEX(['
              - 'iex(['
              - 'iex(New'
              - 'IEX(New'
              - "IEX(('"
              - "iex(('"
        # UTF16 LE
        - CommandLine|contains:
              - 'SQBFAFgAIAAoAFsA'
              - 'kARQBYACAAKABbA'
              - 'JAEUAWAAgACgAWw'
              - 'aQBlAHgAIAAoAFsA'
              - 'kAZQB4ACAAKABbA'
              - 'pAGUAeAAgACgAWw'
              - 'aQBlAHgAIAAoAE4AZQB3A'
              - 'kAZQB4ACAAKABOAGUAdw'
              - 'pAGUAeAAgACgATgBlAHcA'
              - 'SQBFAFgAIAAoAE4AZQB3A'
              - 'kARQBYACAAKABOAGUAdw'
              - 'JAEUAWAAgACgATgBlAHcA'
    condition: selection
falsepositives:
    - Unknown
level: high

KQL (Azure Sentinel)

imProcessCreate
| where (TargetProcessCommandLine contains "SUVYIChb" or TargetProcessCommandLine contains "lFWCAoW" or TargetProcessCommandLine contains "JRVggKF" or TargetProcessCommandLine contains "aWV4IChb" or TargetProcessCommandLine contains "lleCAoW" or TargetProcessCommandLine contains "pZXggKF" or TargetProcessCommandLine contains "aWV4IChOZX" or TargetProcessCommandLine contains "lleCAoTmV3" or TargetProcessCommandLine contains "pZXggKE5ld" or TargetProcessCommandLine contains "SUVYIChOZX" or TargetProcessCommandLine contains "lFWCAoTmV3" or TargetProcessCommandLine contains "JRVggKE5ld" or TargetProcessCommandLine contains "SUVYKF" or TargetProcessCommandLine contains "lFWChb" or TargetProcessCommandLine contains "JRVgoW" or TargetProcessCommandLine contains "aWV4KF" or TargetProcessCommandLine contains "lleChb" or TargetProcessCommandLine contains "pZXgoW" or TargetProcessCommandLine contains "aWV4KE5ld" or TargetProcessCommandLine contains "lleChOZX" or TargetProcessCommandLine contains "pZXgoTmV3" or TargetProcessCommandLine contains "SUVYKE5ld" or TargetProcessCommandLine contains "lFWChOZX" or TargetProcessCommandLine contains "JRVgoTmV3" or TargetProcessCommandLine contains "SUVYKCgn" or TargetProcessCommandLine contains "lFWCgoJ" or TargetProcessCommandLine contains "JRVgoKC" or TargetProcessCommandLine contains "aWV4KCgn" or TargetProcessCommandLine contains "lleCgoJ" or TargetProcessCommandLine contains "pZXgoKC") or (TargetProcessCommandLine contains "SQBFAFgAIAAoAFsA" or TargetProcessCommandLine contains "kARQBYACAAKABbA" or TargetProcessCommandLine contains "JAEUAWAAgACgAWw" or TargetProcessCommandLine contains "aQBlAHgAIAAoAFsA" or TargetProcessCommandLine contains "kAZQB4ACAAKABbA" or TargetProcessCommandLine contains "pAGUAeAAgACgAWw" or TargetProcessCommandLine contains "aQBlAHgAIAAoAE4AZQB3A" or TargetProcessCommandLine contains "kAZQB4ACAAKABOAGUAdw" or TargetProcessCommandLine contains "pAGUAeAAgACgATgBlAHcA" or TargetProcessCommandLine contains "SQBFAFgAIAAoAE4AZQB3A" or TargetProcessCommandLine contains "kARQBYACAAKABOAGUAdw" or TargetProcessCommandLine contains "JAEUAWAAgACgATgBlAHcA")

Required Data Sources

False Positive Guidance

• Unknown

MITRE ATT&CK Context

• Tactic: Execution
• Technique: T1059.001 — PowerShell

References

• Internal Research
• SigmaHQ Rule