Detection of Base64-Encoded Gzip Archive Decompression in PowerShell

Defenders must monitor for suspicious PowerShell activity involving the decoding of base64-encoded Gzip archives. This technique is frequently utilized by threat actors to obfuscate and deliver malicious payloads directly into memory, bypassing disk-based security controls. The specific pattern identified includes the orchestration of 'FromBase64String' for decoding, 'MemoryStream' for buffer management, and the presence of the 'H4sI' Gzip magic header. This combination suggests an attempt to unpack and execute serialized or compressed shellcode or scripts dynamically. Detecting this behavior requires visibility into PowerShell Script Block Logging, as standard command-line logging often fails to capture the contents of dynamic, memory-resident payloads.

Impact

Successful exploitation of this technique allows attackers to execute arbitrary, hidden code within the context of a legitimate process. This facilitates stealthy command-and-control communication, credential dumping, or lateral movement, significantly complicating incident response efforts by obscuring the payload footprint on the target system.

Recommendation

Prioritize visibility into PowerShell activity to detect attempts at in-memory payload delivery.

• Enable PowerShell Script Block Logging (Event ID 4104) across the environment to capture full script content.
• Deploy the Sigma detection rule below to monitor for the specific combination of classes and compression signatures indicative of this technique.
• Tune the detection logic for legitimate administrative scripts that may utilize similar compression utilities for maintenance tasks.