Issue 575 page 43

2022-12-23 11:10:17 +01:00
parent b200b5dedb
commit bee5b2f252
2 changed files with 47 additions and 0 deletions
@@ -0,0 +1,24 @@
+title: Suspicious FromBase64String Gzip Archive - Ps Script
+id: df69cb1d-b891-4cd9-90c7-d617d90100ce
+related:
+    - id: d75d6b6b-adb9-48f7-824b-ac2e786efe1f
+      type: similar
+status: experimental
+description: Detect use of a Gzip archive in a base64 string
+references:
+    - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
+author: frack113
+date: 2022/12/23
+logsource:
+    product: windows
+    category: ps_script
+    definition: Script block logging must be enabled
+detection:
+    selection:
+        ScriptBlockText|contains|all:
+            - 'FromBase64String'
+            - 'H4sI'
+    condition: selection
+falsepositives:
+    - Legitimate administrative script
+level: medium