Script block that encodes data and then sends it outbound

Siemphony@siemphonymediumT1132.001unverifiedPlaybook · Defence evasion

Matches a PowerShell script block that both calls a standard encoder or compressor and, in the same block, reaches the network. MITRE's AN0345 describes a chain — encode, then egress within a tunable TimeWindow — which Sigma cannot join across events, so the chain is collapsed into a single 4104 record where the two halves appear together; a script that encodes in one block and uploads in another will not match. EventID is matched explicitly because the logsource is the raw PowerShell channel, whose other event IDs do not carry ScriptBlockText. The B64LengthThreshold, PayloadEntropyThreshold and BytesOutToInRatio knobs are all thresholds over payload or flow data that a script-block event does not contain, so none of them are encoded here. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0124, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Script block that encodes data and then sends it outbound2id: 2d6b83f5-41ae-4c09-8e73-b5a1f9207cd43status: experimental4description: |5  Matches a PowerShell script block that both calls a standard encoder or6  compressor and, in the same block, reaches the network. MITRE's AN0345 describes7  a chain — encode, then egress within a tunable TimeWindow — which Sigma cannot8  join across events, so the chain is collapsed into a single 4104 record where the9  two halves appear together; a script that encodes in one block and uploads in10  another will not match. EventID is matched explicitly because the logsource is11  the raw PowerShell channel, whose other event IDs do not carry ScriptBlockText.12  The B64LengthThreshold, PayloadEntropyThreshold and BytesOutToInRatio knobs are13  all thresholds over payload or flow data that a script-block event does not14  contain, so none of them are encoded here.15  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0124, not hand-written and not tested by its author. Any lab result is on this rule's own page.16references:17  - https://attack.mitre.org/techniques/T1132/00118  - https://attack.mitre.org/detectionstrategies/DET012419author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)20date: 2026-08-1621tags:22  - attack.command-and-control23  - attack.t1132.00124logsource:25  product: windows26  service: powershell27detection:28  selection_encoder:29    EventID: 410430    ScriptBlockText|contains:31      - 'ToBase64String'32      - 'FromBase64String'33      - 'ToBase64Transform'34      - 'FromBase64Transform'35      - 'ToBase64CharArray'36      - 'FromBase64CharArray'37      - 'EncodedCommand'38      - 'BitConverter]::ToString'39      - 'GZipStream'40      - 'DeflateStream'41  selection_egress:42    ScriptBlockText|contains:43      - 'Net.WebClient'44      - 'UploadString'45      - 'UploadData'46      - 'UploadFile'47      - 'Invoke-WebRequest'48      - 'Invoke-RestMethod'49      - 'HttpWebRequest'50      - 'Net.Http.HttpClient'51      - 'Net.Sockets.TcpClient'52      - 'Resolve-DnsName'53  condition: selection_encoder and selection_egress54falsepositives:55  - "API automation that builds an HTTP Basic authorization header with `[Convert]::ToBase64String` and then calls Invoke-RestMethod. This is structurally the same logic the rule looks for and is the single largest source of noise; it is what MITRE's KnownAdminTools knob is for, and the allowlist has to be by script path or signing certificate, not by keyword."56  - "Backup, telemetry and log-shipping scripts that compress with GZipStream or DeflateStream before an UploadData call. MITRE separates these from C2 with the BytesOutToInRatio and PayloadEntropyThreshold knobs, neither of which is available in a script-block event, so they cannot be filtered out here."57  - "Deployment and configuration tooling that fetches content with Invoke-WebRequest and unpacks an embedded base64 blob — a certificate, a licence file, a settings bundle — with FromBase64String in the same block."58  - "Nested-quoting workarounds where an administrative script launches a child PowerShell with -EncodedCommand and also performs a web call, encoding for convenience rather than evasion."59level: medium

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "ToBase64String" or ScriptBlockText contains "FromBase64String" or ScriptBlockText contains "ToBase64Transform" or ScriptBlockText contains "FromBase64Transform" or ScriptBlockText contains "ToBase64CharArray" or ScriptBlockText contains "FromBase64CharArray" or ScriptBlockText contains "EncodedCommand" or ScriptBlockText contains "BitConverter]::ToString" or ScriptBlockText contains "GZipStream" or ScriptBlockText contains "DeflateStream")) and (ScriptBlockText contains "Net.WebClient" or ScriptBlockText contains "UploadString" or ScriptBlockText contains "UploadData" or ScriptBlockText contains "UploadFile" or ScriptBlockText contains "Invoke-WebRequest" or ScriptBlockText contains "Invoke-RestMethod" or ScriptBlockText contains "HttpWebRequest" or ScriptBlockText contains "Net.Http.HttpClient" or ScriptBlockText contains "Net.Sockets.TcpClient" or ScriptBlockText contains "Resolve-DnsName"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*ToBase64String*" OR ScriptBlockText="*FromBase64String*" OR ScriptBlockText="*ToBase64Transform*" OR ScriptBlockText="*FromBase64Transform*" OR ScriptBlockText="*ToBase64CharArray*" OR ScriptBlockText="*FromBase64CharArray*" OR ScriptBlockText="*EncodedCommand*" OR ScriptBlockText="*BitConverter]::ToString*" OR ScriptBlockText="*GZipStream*" OR ScriptBlockText="*DeflateStream*")) AND (ScriptBlockText="*Net.WebClient*" OR ScriptBlockText="*UploadString*" OR ScriptBlockText="*UploadData*" OR ScriptBlockText="*UploadFile*" OR ScriptBlockText="*Invoke-WebRequest*" OR ScriptBlockText="*Invoke-RestMethod*" OR ScriptBlockText="*HttpWebRequest*" OR ScriptBlockText="*Net.Http.HttpClient*" OR ScriptBlockText="*Net.Sockets.TcpClient*" OR ScriptBlockText="*Resolve-DnsName*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*tobase64string*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*frombase64string*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*tobase64transform*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*frombase64transform*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*tobase64chararray*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*frombase64chararray*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*encodedcommand*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*bitconverter]::tostring*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*gzipstream*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*deflatestream*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*net.webclient*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*uploadstring*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*uploaddata*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*uploadfile*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-webrequest*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*invoke-restmethod*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*httpwebrequest*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*net.http.httpclient*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*net.sockets.tcpclient*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*resolve-dnsname*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(ToBase64String|FromBase64String|ToBase64Transform|FromBase64Transform|ToBase64CharArray|FromBase64CharArray|EncodedCommand|BitConverter\]::ToString|GZipStream|DeflateStream)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(Net\.WebClient|UploadString|UploadData|UploadFile|Invoke-WebRequest|Invoke-RestMethod|HttpWebRequest|Net\.Http\.HttpClient|Net\.Sockets\.TcpClient|Resolve-DnsName)</field>    <description>Script block that encodes data and then sends it outbound</description>    <mitre>      <id>T1132.001</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 2d6b83f5-41ae-4c09-8e73-b5a1f9207cd4

ATT&CKT1132.001

T1132.001Standard Encoding

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1132.001, evaluated against their — events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter module source paths first: \Program Files\WindowsPowerShell\Modules\
Split the decode-side keywords into a separate T1027/T1059.001 rule and keep
MITRE's KnownAdminTools knob has to be applied by script path or signing
B64LengthThreshold and PayloadEntropyThreshold need a regex or a

Declared by the author

API automation that builds an HTTP Basic authorization header with [Convert]::ToBase64String and then calls Invoke-RestMethod. This is structurally the same logic the rule looks for and is the single largest source of noise; it is what MITRE's KnownAdminTools knob is for, and the allowlist has to be by script path or signing certificate, not by keyword.
Backup, telemetry and log-shipping scripts that compress with GZipStream or DeflateStream before an UploadData call. MITRE separates these from C2 with the BytesOutToInRatio and PayloadEntropyThreshold knobs, neither of which is available in a script-block event, so they cannot be filtered out here.
Deployment and configuration tooling that fetches content with Invoke-WebRequest and unpacks an embedded base64 blob — a certificate, a licence file, a settings bundle — with FromBase64String in the same block.
Nested-quoting workarounds where an administrative script launches a child PowerShell with -EncodedCommand and also performs a web call, encoding for convenience rather than evasion.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

One PowerShell script block that both calls an encoder or compressor and reaches the network. MITRE's AN0345 is a chain — encode, then egress within a tunable TimeWindow, with an asymmetric bytes-out:bytes-in ratio. Sigma cannot join two events, so the chain is collapsed: both halves must appear inside a single EventID 4104 record. A script that encodes in one block and uploads in another does not match, and the rule says so in its own description. That collapse is the single most important thing to understand here. It turns a behavioural chain into a co-occurrence test over one text field, and every weakness below follows from it.

02 · Telemetry you need

PowerShell Script Block Logging must be enabled. The logsource is
On an estate shipping only the classic Windows PowerShell channel (400/600/

03 · How the logic works

Both selections read the same field. There is no ordering, no adjacency, no notion of data flow — the rendered SPL is two AND-ed alternations over ScriptBlockText. A three-line exfil stub and a 500-line administration script that base64s a credential at the top and calls a REST API at the bottom score identically. The rule is structurally biased toward long, legitimate scripts, because a longer block is more likely to contain both halves by coincidence. Half of `selection_encoder` points the wrong way down the wire. FromBase64String, FromBase64Transform, FromBase64CharArray and EncodedCommand are decoding and obfuscated invocation — T1027 and T1059.001. Paired with Invoke-WebRequest they describe a downloader: fetch a blob, decode it, run it. That is T1105, the opposite direction from the encoded-exfiltration behaviour T1132.001 names. The rule will fire more often on staging than on C2 encoding, and the attack.command-and-control tag will be wrong every time it does. On MITRE attribution: the brief's knobs are PayloadEntropyThreshold, B64LengthThreshold, TimeWindow, KnownAdminTools and BytesOutToInRatio. Four of the five are thresholds over payload or flow data that a script-block event simply does not contain. The keyword lists above are the author's, not MITRE's — MITRE supplied no terms at all.

04 · Common false positives

Module import is the dominant volume source. EventID 4104 logs the source
API automation building an HTTP Basic header with [Convert]::ToBase64String
Backup and log-shipping scripts that GZipStream before UploadData.
Deployment tooling that fetches content and unpacks an embedded base64 blob.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0124, never run against a log line. level: medium is an estimate.
tier_2: means measuring how much of the volume is module import versus real script execution.
tier_3: means restoring MITRE's join: the 4104 encode event correlated with a Sysmon EventID 3 egress inside TimeWindow, with the flow ratio applied. Note how cheap the evasion is meanwhile — split encode and send across two blocks, or concatenate the method name as 'FromBase'+'64String'.

Related detections2 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/2d6b83f5-41ae-4c09-8e73-b5a1f9207cd4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Script block that encodes data and then sends it outbound

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it