heroui logo

PowerShell Base64 Encoded IEX Cmdlet

Sigma Rules

View Source
Summary
This detection rule aims to identify the use of Base64 encoded PowerShell commands that leverage the `IEX` (Invoke-Expression) cmdlet in Windows processes. The `IEX` cmdlet is often used in malicious scripts to execute Base64 decoded commands, making it critical to detect its use in potentially malicious contexts. The rule monitors the command line arguments of processes for indicators of this behavior, such as variations of `IEX` usage along with specific Base64 encoded strings. The detection logic checks for both explicit mentions of `IEX` in various forms and a set of known Base64 encoded payloads that are commonly associated with nefarious activities. Given that this technique is indicative of code execution attacks, it has been classified with a high threat level.
Categories
  • Endpoint
  • Windows
  • Application
Data Sources
  • Process
Created: 2019-08-23