From bee5b2f2529cb7febed738767aef5e68c12a5871 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Fri, 23 Dec 2022 11:10:17 +0100
Subject: [PATCH] Issue 575 page 43

---
 .../posh_ps_frombase64string_archive.yml      | 24 +++++++++++++++++++
 ..._creation_win_frombase64string_archive.yml | 23 ++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml
 create mode 100644 rules/windows/process_creation/proc_creation_win_frombase64string_archive.yml

diff --git a/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml b/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml
new file mode 100644
index 000000000..f5d440162
--- /dev/null
+++ b/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml
@@ -0,0 +1,24 @@
+title: Suspicious FromBase64String Gzip Archive - Ps Script
+id: df69cb1d-b891-4cd9-90c7-d617d90100ce
+related:
+    - id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
+      type: similar
+status: experimental
+description: Detect use of a Gzip archive in a base64 string
+references:
+    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
+author: frack113
+date: 2022/12/23
+logsource:
+    product: windows
+    category: ps_script
+    definition: Script block logging must be enabled
+detection:
+    selection:
+        ScriptBlockText|contains|all:
+            - 'FromBase64String'
+            - 'H4sI'
+    condition: selection
+falsepositives:
+    - Legitimate administrative script
+level: medium
diff --git a/rules/windows/process_creation/proc_creation_win_frombase64string_archive.yml b/rules/windows/process_creation/proc_creation_win_frombase64string_archive.yml
new file mode 100644
index 000000000..0830c8dee
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_frombase64string_archive.yml
@@ -0,0 +1,23 @@
+title: Suspicious FromBase64String Gzip Archive - Process Creation
+id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
+related:
+    - id: df69cb1d-b891-4cd9-90c7-d617d90100ce
+      type: similar
+status: experimental
+description: Detect use of a Gzip archive in a base64 string
+references:
+    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
+author: frack113
+date: 2022/12/23
+logsource:
+    product: windows
+    category: process_creation
+detection:
+    selection:
+        CommandLine|contains|all:
+            - 'FromBase64String'
+            - 'H4sI'
+    condition: selection
+falsepositives:
+    - Legitimate administrative script
+level: medium