Hub configuration

Name: PowerShell Base64 Encoded Reflective Assembly Load
Author: sigmahq

More info

1type: trigger

2name: sigmahq/proc_creation_win_powershell_base64_reflection_assembly_load

3description: |

4 Detects base64 encoded .NET reflective loading of Assembly

5filter: |

6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && (evt.Parsed.CommandLine contains 'WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA' || evt.Parsed.CommandLine contains 'sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA' || evt.Parsed.CommandLine contains 'bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA' || evt.Parsed.CommandLine contains 'AFsAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiAC' || evt.Parsed.CommandLine contains 'BbAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgAp' || evt.Parsed.CommandLine contains 'AWwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAK' || evt.Parsed.CommandLine contains 'WwBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6ACgAIgBMAG8AYQBkACIAKQ' || evt.Parsed.CommandLine contains 'sAUgBlAGYAbABlAGMAdABpAG8AbgAuAEEAcwBzAGUAbQBiAGwAeQBdADoAOgAoACIATABvAGEAZAAiACkA' || evt.Parsed.CommandLine contains 'bAFIAZQBmAGwAZQBjAHQAaQBvAG4ALgBBAHMAcwBlAG0AYgBsAHkAXQA6ADoAKAAiAEwAbwBhAGQAIgApA' || evt.Parsed.CommandLine contains 'WwByAGUAZgBsAGUAYwB0AGkAbwBuAC4AYQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKA' || evt.Parsed.CommandLine contains 'sAcgBlAGYAbABlAGMAdABpAG8AbgAuAGEAcwBzAGUAbQBiAGwAeQBdADoAOgBMAG8AYQBkACgA' || evt.Parsed.CommandLine contains 'bAHIAZQBmAGwAZQBjAHQAaQBvAG4ALgBhAHMAcwBlAG0AYgBsAHkAXQA6ADoATABvAGEAZAAoA')

7blackhole: 2m

8#status: test

9labels:

10 service: windows

11 confidence: 1

12 spoofable: 0

13 classification:

14 - attack.t1059.001

15 - attack.t1027

16 - attack.t1620

18 label: "PowerShell Base64 Encoded Reflective Assembly Load"

19 behavior : "windows:audit"

20 remediation: false

22scope:

23 type: ParentProcessId

24 expression: evt.Parsed.ParentProcessId

Hub configuration

« PowerShell Base64 Encoded Reflective Assembly Load »v0.2 by sigmahq / proc_creation_win_powershell_base64_reflection_assembly_loadAttack scenariowindowsNot spoofableLow confidenceMITRE:t1059MITRE:t1027MITRE:t1620

« PowerShell Base64 Encoded Reflective Assembly Load »
v0.2 by sigmahq / proc_creation_win_powershell_base64_reflection_assembly_load
Attack scenariowindowsNot spoofableLow confidence