Suspicious XOR Encoded PowerShell Command Execution
This detection addresses the use of XOR obfuscation within PowerShell command lines, a technique frequently used by threat actors to conceal malicious payloads and evade signature-based detection.
Triage facts
Revision 1- Applicability
- Windows
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 10, 03:40 UTC
- Detection
- 1 rule
- Source quality
- B2Likely
Adversaries often utilize XOR encoding and various string manipulation techniques in PowerShell to bypass security controls. By leveraging XOR operations, attackers can obfuscate command logic, script content, or downloaded payloads, rendering standard keyword-based detection ineffective. The presence of XOR logic (bxor) combined with script-based loop and concatenation primitives (ForEach, for, -join, [char]) is a common indicator of obfuscated execution.
Recommendation
- Deploy the provided Sigma rule to identify obfuscated PowerShell command lines.
- Baseline common administrative scripts in your environment that utilize string manipulation or character encoding to reduce false positives.
- Enhance visibility by enabling PowerShell Script Block Logging (Event ID 4104) to capture the de-obfuscated code during runtime execution, as command-line logging can be bypassed or restricted by length limitations.
Immediate actions
Deploy Sigma rule for PowerShell XOR detection
Threat Hunt
Identify PowerShell command lines with high entropy or character frequency
Data: Process Command Line
Detection coverage 1
Detect Suspicious XOR Encoded PowerShell Command
mediumDetects PowerShell command lines containing XOR operations combined with common character manipulation and loop primitives, often used for script obfuscation.
Detection queries are available on the platform. Get full rules →