cscli scenarios install sigmahq/proc_creation_win_powershell_cmdline_reversed_strings1type: trigger2name: sigmahq/proc_creation_win_powershell_cmdline_reversed_strings3description: |4 Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers5filter: |6 (evt.Meta.service == 'sysmon' && evt.Parsed.EventID == '1') && ((evt.Parsed.Image endsWith '\\powershell.exe' || evt.Parsed.Image endsWith '\\pwsh.exe' || evt.Parsed.OriginalFileName in ['PowerShell.EXE', 'pwsh.dll']) && (evt.Parsed.CommandLine contains 'hctac' || evt.Parsed.CommandLine contains 'kaerb' || evt.Parsed.CommandLine contains 'dnammoc' || evt.Parsed.CommandLine contains 'ekovn' || evt.Parsed.CommandLine contains 'eliFd' || evt.Parsed.CommandLine contains 'rahc' || evt.Parsed.CommandLine contains 'etirw' || evt.Parsed.CommandLine contains 'golon' || evt.Parsed.CommandLine contains 'tninon' || evt.Parsed.CommandLine contains 'eddih' || evt.Parsed.CommandLine contains 'tpircS' || evt.Parsed.CommandLine contains 'ssecorp' || evt.Parsed.CommandLine contains 'llehsrewop' || evt.Parsed.CommandLine contains 'esnopser' || evt.Parsed.CommandLine contains 'daolnwod' || evt.Parsed.CommandLine contains 'tneilCbeW' || evt.Parsed.CommandLine contains 'tneilc' || evt.Parsed.CommandLine contains 'ptth' || evt.Parsed.CommandLine contains 'elifotevas' || evt.Parsed.CommandLine contains '46esab' || evt.Parsed.CommandLine contains 'htaPpmeTteG' || evt.Parsed.CommandLine contains 'tcejbO' || evt.Parsed.CommandLine contains 'maerts' || evt.Parsed.CommandLine contains 'hcaerof' || evt.Parsed.CommandLine contains 'retupmoc') && not (evt.Parsed.CommandLine contains ' -EncodedCommand ' || evt.Parsed.CommandLine contains ' -enc '))7blackhole: 2m8#status: test9labels:10 service: windows11 confidence: 112 spoofable: 013 classification:14 - attack.t102715 - attack.t1059.0011617 label: "Potential PowerShell Obfuscation Via Reversed Commands"18 behavior : "windows:audit"19 remediation: false2021scope:22 type: ParentProcessId23 expression: evt.Parsed.ParentProcessId2425