Potential PowerShell Obfuscation via Special Character Overuse

 1[metadata]
 2creation_date = "2025/04/16"
 3integration = ["windows"]
 4maturity = "production"
 5updated_date = "2025/04/16"
 6
 7[rule]
 8author = ["Elastic"]
 9description = """
10Identifies PowerShell scripts with an unusually high proportion of whitespace and special characters, often indicative
11of obfuscation. This behavior is commonly associated with techniques such as SecureString encoding, formatting
12obfuscation, or character-level manipulation designed to bypass static analysis and AMSI inspection.
13"""
14from = "now-9m"
15language = "esql"
16license = "Elastic License v2"
17name = "Potential PowerShell Obfuscation via Special Character Overuse"
18risk_score = 21
19rule_id = "6ddb6c33-00ce-4acd-832a-24b251512023"
20setup = """## Setup
21
22The 'PowerShell Script Block Logging' logging policy must be enabled.
23Steps to implement the logging policy with Advanced Audit Configuration:

1
2Steps to implement the logging policy via registry:

 1"""
 2severity = "low"
 3tags = [
 4    "Domain: Endpoint",
 5    "OS: Windows",
 6    "Use Case: Threat Detection",
 7    "Tactic: Defense Evasion",
 8    "Data Source: PowerShell Logs",
 9]
10timestamp_override = "event.ingested"
11type = "esql"
12
13query = '''
14FROM logs-windows.powershell_operational* metadata _id, _version, _index
15| WHERE event.code == "4104"
16
17// Look for scripts with more than 1000 chars that contain a related keyword
18| EVAL script_len = LENGTH(powershell.file.script_block_text)
19| WHERE script_len > 1000
20
21// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
22// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
23| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[\s\$\{\}\+\@\=\(\)\^\\\"~\[\]\?\.]""", "🔥")
24
25// Count the occurrence of numbers and their proportion to the total chars in the script
26| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
27| EVAL proportion = special_count::double / script_len::double
28
29// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
30| KEEP special_count, script_len, proportion, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
31
32// Filter for scripts with a 75%+ proportion of numbers
33| WHERE proportion > 0.75
34'''
35
36
37[[rule.threat]]
38framework = "MITRE ATT&CK"
39[[rule.threat.technique]]
40id = "T1027"
41name = "Obfuscated Files or Information"
42reference = "https://attack.mitre.org/techniques/T1027/"
43
44[[rule.threat.technique]]
45id = "T1140"
46name = "Deobfuscate/Decode Files or Information"
47reference = "https://attack.mitre.org/techniques/T1140/"
48
49
50[rule.threat.tactic]
51id = "TA0005"
52name = "Defense Evasion"
53reference = "https://attack.mitre.org/tactics/TA0005/"
54[[rule.threat]]
55framework = "MITRE ATT&CK"
56[[rule.threat.technique]]
57id = "T1059"
58name = "Command and Scripting Interpreter"
59reference = "https://attack.mitre.org/techniques/T1059/"
60[[rule.threat.technique.subtechnique]]
61id = "T1059.001"
62name = "PowerShell"
63reference = "https://attack.mitre.org/techniques/T1059/001/"
64
65
66
67[rule.threat.tactic]
68id = "TA0002"
69name = "Execution"
70reference = "https://attack.mitre.org/tactics/TA0002/"