Obfuscated command line via caret escaping or string splicing

1title: Obfuscated command line via caret escaping or string splicing2id: 8f30bca2-dc70-4991-8b5a-991dcf7dd7c03status: experimental4description: |5  AN1394 asks for "excessive escape characters, base64 encoding, command6  concatenation, or outlier command length and entropy" on a single 46887  record, and this rule takes the three of those four that are actual string8  shapes rather than a statistic: `CommandLineEntropyThreshold` and9  `SuspiciousCharacterCount` are both a measurement over the whole string, and10  lib/sigma has no entropy or length function, so neither knob can be applied11  as MITRE defines it. In its place, three concrete constructions the12  technique's own description names are matched directly. `selection_encoded`13  is `-EncodedCommand`/`-enc` on a PowerShell host process — the base6414  leg, and the one MITRE calls out first, standing in for15  `CommandLineEntropyThreshold` because the flag is a reliable proxy for a16  high-entropy blob even though the blob's entropy itself is unmeasured.17  `selection_caret` is `SuspiciousCharacterCount` made concrete: five or more18  `^`-escaped characters in a row, the shape produced by `p^o^w^e^r^s^h^e^l^l`19  or `c^m^d`, a cmd.exe evasion old enough to predate this ATT&CK release.20  `selection_concat` matches the technique description's own worked example —21  two double-quoted fragments joined by `+`, as in `"Wor"+"d.Application"` —22  which is string-splitting obfuscation regardless of which interpreter runs23  it. The brief maps Security 4688 onto Sigma's `process_creation` category,24  which is Sysmon-shaped; this rule is written in that vocabulary25  (`Image`, `CommandLine`), so a raw 4688 feed needs `NewProcessName` mapped to26  `Image` before it applies, and 4688 itself needs *Audit Process Creation*27  plus the separate *Include command line in process creation events* policy —28  neither is on by default or in the CIS baseline, and without the29  command-line policy every event arrives with an empty `CommandLine` and this30  rule silently matches nothing. `TimeWindow`, correlating the obfuscated31  command to a later child process or file write, is not attempted — lib/sigma32  has no timeframe construct. The inline-string decode this rule targets is33  deliberately distinct from T1027.013, which covers an encoded or encrypted34  *file* read from disk; `selection_encoded` here fires on the flag alone with35  no file argument required.36  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0505, not hand-written and not tested by its author. Any lab result is on this rule's own page.37references:38  - https://attack.mitre.org/techniques/T1027/01039  - https://attack.mitre.org/detectionstrategies/DET050540author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)41date: 2026-08-1742tags:43  - attack.defense-evasion44  - attack.t1027.01045logsource:46  category: process_creation47  product: windows48detection:49  selection_encoded:50    Image|endswith:51      - '\powershell.exe'52      - '\pwsh.exe'53    CommandLine|contains|windash:54      - '-enc'55      - '-EncodedCommand'56  selection_caret:57    CommandLine|re: '(\^[A-Za-z]){5,}'58  selection_concat:59    CommandLine|re: '"[^"]{1,40}"\s*\+\s*"[^"]{1,40}"'60  condition: 1 of selection*61falsepositives:62  - "Enterprise PowerShell deployment tooling. SCCM, Intune, GPO logon scripts and CI/CD runners routinely pass -EncodedCommand to avoid multi-layer quoting problems when a script crosses shells or a scheduler, and this is the highest-volume match in most estates, which is why the level is medium rather than high."63  - "Legacy VBScript and batch logon scripts that build COM automation strings by concatenation as ordinary (if dated) programming style, such as CreateObject(\"Wor\" + \"d.Application\") written by a non-security author with no intent to evade anything."64  - "Installer and packaging tooling — WiX, InstallShield and older NSIS-generated batch wrappers — that caret-escapes every token defensively regardless of whether escaping is actually required, producing the same five-or-more ^-escaped run this rule matches."65  - "Security-awareness and detection-engineering exercises that run canonical obfuscated-PowerShell samples from public trainings and atomic-test repositories, which reproduce this exact shape on analyst and lab workstations."66level: medium