Detection of PowerShell Base64 Decoding Techniques

Attackers frequently utilize Base64 encoding to obfuscate malicious PowerShell scripts, command-and-control beacons, and payloads. By encoding scripts, adversaries attempt to evade static analysis and security signatures that monitor for specific keywords or malicious patterns within a command line. A common method to execute these encoded commands involves the use of the .NET 'FromBase64String' function, which decodes the obfuscated input before execution. This technique is pervasive across various stages of an attack, including initial staging and lateral movement. Defenders should monitor for the presence of '::FromBase64String(' within process execution telemetry to identify potentially obfuscated PowerShell activity, as this is a high-signal indicator of defensive evasion despite the existence of some legitimate administrative script usage.

Impact

Successful exploitation of obfuscation techniques allows attackers to bypass baseline security monitoring, facilitating the delivery of secondary payloads, credential harvesting, or unauthorized system access while remaining undetected by simple keyword-based defensive rules.

Recommendation

Deploy the Sigma rule below to detect potentially malicious PowerShell activity. Prioritize alerting on executions from non-administrative contexts. Review existing automation and deployment scripts that may trigger this rule to reduce false positives through inclusion of authorized process paths.