blue-team-tools/rules/windows/process_creation/win_powershell_cmdline_reversed_strings.yml

title: Suspicious PowerShell Cmdline
id: b6b49cd1-34d6-4ead-b1bf-176e9edba9a4
status: test
description: Detects the PowerShell command lines with reversed strings
author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community
references:
  - https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66
date: 2020/10/11
modified: 2021/11/27
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\powershell.exe'
    CommandLine|contains:
      - 'hctac'
      - 'kearb'
      - 'dnammoc'
      - 'ekovn'
      - 'eliFd'
      - 'rahc'
      - 'etirw'
      - 'golon'
      - 'tninon'
      - 'eddih'
      - 'tpircS'
      - 'ssecorp'
      - 'llehsrewop'
      - 'esnopser'
      - 'daolnwod'
      - 'tneilCbeW'
      - 'tneilc'
      - 'ptth'
      - 'elifotevas'
      - '46esab'
      - 'htaPpmeTteG'
      - 'tcejbO'
      - 'maerts'
      - 'hcaerof'
      - 'ekovni'
      - 'retupmoc'
  condition: selection
falsepositives:
  - Unlikely
level: high
tags:
  - attack.defense_evasion
  - attack.t1027
  - attack.execution
  - attack.t1059.001