SigmaHQ/rules/windows/process_creation/win_powershell_b64_shellcode.yml

27 lines
649 B
YAML
Raw Normal View History

title: PowerShell Base64 Encoded Shellcode
2019-11-12 22:12:27 +00:00
id: 2d117e49-e626-4c7c-bd1f-c3c0147774c8
description: Detects Base64 encoded Shellcode
status: experimental
references:
- https://twitter.com/cyb3rops/status/1063072865992523776
author: Florian Roth
date: 2018/11/17
2020-09-02 00:34:34 +00:00
modified: 2020/09/01
tags:
- attack.defense_evasion
2020-09-02 00:34:34 +00:00
- attack.t1027
logsource:
category: process_creation
product: windows
detection:
selection1:
CommandLine: '*AAAAYInlM*'
selection2:
CommandLine:
- '*OiCAAAAYInlM*'
- '*OiJAAAAYInlM*'
condition: selection1 and selection2
falsepositives:
- Unknown
level: critical