Rule: Detect base64 encoded PowerShell shellcode

https://twitter.com/cyb3rops/status/1063072865992523776
2018-11-17 09:10:09 +01:00
parent b92c032c2d
commit fd06cde641
2 changed files with 69 additions and 0 deletions
@@ -0,0 +1,25 @@
+title: PowerShell ShellCode
+status: experimental
+description: Detects Base64 encoded Shellcode
+references:
+    - https://twitter.com/cyb3rops/status/1063072865992523776
+tags:
+    - attack.execution
+author: David Ledbetter (shellcode), Florian Roth (rule)
+date: 2018/11/17
+logsource:
+    product: windows
+    service: powershell
+    description: 'Script block logging must be enabled'
+detection:
+    selection:
+        EventID: 4104
+    keyword1: 
+        - '*AAAAYInlM*'
+    keyword2: 
+        - '*OiCAAAAYInlM*'
+        - '*OiJAAAAYInlM*'
+    condition: selection and keyword1 and keyword2
+falsepositives:
+    - Unknown
+level: critical