Custom byte-level encoding routine run inline against file data

1title: Custom byte-level encoding routine run inline against file data2id: ac389ad6-e0b0-4634-8aa3-c9bf5d2cd6d43status: experimental4description: |5  Matches a shell one-liner that combines a bitwise byte operation with reading or6  writing file contents — the hand-rolled XOR or stream-cipher routine AN12137  describes as producing archive-like output with no standard archiving utility8  involved. Archiving utilities and their verbs are absent from the logic because9  that is T1560.001, and so are the .NET compression and cryptography stream10  classes, because library-backed archiving is T1560.002; what is left is the raw11  arithmetic that makes a method custom, which is what this sub-technique is12  about. The brief maps Security EventID 4688 onto the Sysmon-shaped13  `process_creation` category, and this rule is written in the Sysmon EventID 114  vocabulary (`Image`, `CommandLine`): the 4688 feed carries the same data under15  `NewProcessName` and needs a field mapping first, as well as both Audit Process16  Creation and the separate Include command line in process creation events17  policy, neither of which is enabled by default or by the CIS baseline. Only18  inline routines are visible here — a `-EncodedCommand` blob or a routine living19  in a .ps1 file puts none of these strings on the command line — and the20  interpreter list is confined to PowerShell because the operators matched are21  PowerShell syntax, so listing wscript or cscript would add selectors that can22  never fire.23  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0438, not hand-written and not tested by its author. Any lab result is on this rule's own page.24references:25  - https://attack.mitre.org/techniques/T1560/00326  - https://attack.mitre.org/detectionstrategies/DET043827author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)28date: 2026-08-1629tags:30  - attack.collection31  - attack.t1560.00332logsource:33  category: process_creation34  product: windows35detection:36  selection_shell:37    Image|endswith:38      - '\powershell.exe'39      - '\pwsh.exe'40  selection_bitwise:41    CommandLine|contains:42      - '-bxor'43      - '-bnot'44      - '-band'45      - '-shl'46      - '-shr'47  selection_file_io:48    CommandLine|contains:49      - 'ReadAllBytes'50      - 'WriteAllBytes'51      - 'FileStream'52      - 'OpenRead'53      - 'OpenWrite'54      - 'Get-Content'55      - 'Set-Content'56      - '-AsByteStream'57      - '-Encoding Byte'58  condition: selection_shell and selection_bitwise and selection_file_io59falsepositives:60  - "In-house automation that folds bytes while converting a file — checksum and CRC helpers, binary patching, licence and header manipulation — which reads with ReadAllBytes or Get-Content and applies -bxor or -band before writing the result back. This is the most common way the rule fires and nothing in the event separates it from staging for exfiltration."61  - "Vendor installers, endpoint agent modules and deployment scripts that unpack an embedded, XOR-obfuscated payload to disk during setup; the routine is byte-identical to the malicious one and repeats on every host in a rollout wave."62  - "Telemetry and log converters that read a binary file as a byte stream and mask off flag bits before writing a normalised copy, typically running on a schedule from the same few servers."63  - "Malware analysis, detection engineering and training workstations, where operators run byte-manipulation one-liners against sample files as routine daily work."64level: medium