PowerShell Obfuscation via Negative Index String Reversal

 1[metadata]
 2creation_date = "2025/04/14"
 3integration = ["windows"]
 4maturity = "production"
 5updated_date = "2025/04/14"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies PowerShell scripts that use negative index ranges to reverse the contents of a string or array at runtime as
11a form of obfuscation. This technique avoids direct use of reversal functions by iterating through array elements in
12reverse order. These methods are designed to evade static analysis and bypass security protections such as the
13Antimalware Scan Interface (AMSI).
14"""
15from = "now-9m"
16language = "esql"
17license = "Elastic License v2"
18name = "PowerShell Obfuscation via Negative Index String Reversal"
19risk_score = 21
20rule_id = "9edd1804-83c7-4e48-b97d-c776b4c97564"
21setup = """## Setup
22
23The 'PowerShell Script Block Logging' logging policy must be enabled.
24Steps to implement the logging policy with Advanced Audit Configuration:

1
2Steps to implement the logging policy via registry:

 1"""
 2severity = "low"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Defense Evasion",
 8    "Data Source: PowerShell Logs",
 9]
10timestamp_override = "event.ingested"
11type = "esql"
12
13query = '''
14FROM logs-windows.powershell_operational* metadata _id, _version, _index
15| WHERE event.code == "4104"
16
17// Look for scripts with more than 500 chars that contain a related keyword
18| EVAL script_len = LENGTH(powershell.file.script_block_text)
19| WHERE script_len > 500
20
21// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
22// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
23| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """\$\w+\[\-\s?1\.\.""", "🔥")
24
25// Count how many patterns were detected by calculating the number of 🔥 characters inserted
26| EVAL count = LENGTH(replaced_with_fire) - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
27
28// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
29| KEEP count, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
30| WHERE count >= 1
31
32// FP Patterns
33| WHERE NOT powershell.file.script_block_text LIKE "*GENESIS-5654*"
34'''
35
36
37[[rule.threat]]
38framework = "MITRE ATT&CK"
39[[rule.threat.technique]]
40id = "T1027"
41name = "Obfuscated Files or Information"
42reference = "https://attack.mitre.org/techniques/T1027/"
43
44[[rule.threat.technique]]
45id = "T1140"
46name = "Deobfuscate/Decode Files or Information"
47reference = "https://attack.mitre.org/techniques/T1140/"
48
49
50[rule.threat.tactic]
51id = "TA0005"
52name = "Defense Evasion"
53reference = "https://attack.mitre.org/tactics/TA0005/"
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1059"
58name = "Command and Scripting Interpreter"
59reference = "https://attack.mitre.org/techniques/T1059/"
60[[rule.threat.technique.subtechnique]]
61id = "T1059.001"
62name = "PowerShell"
63reference = "https://attack.mitre.org/techniques/T1059/001/"
64
65
66
67[rule.threat.tactic]
68id = "TA0002"
69name = "Execution"
70reference = "https://attack.mitre.org/tactics/TA0002/"