Base64 Encoded PowerShell Command Detected

Title: Base64 Encoded PowerShell Command Detected
Status: test
Description:Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
References:
  -https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639
Author: Florian Roth (Nextron Systems)
Date: 2020-01-29
modified:2023-01-26
Tags:

• -'attack.stealth'
• -'attack.t1027'
• -'attack.execution'
• -'attack.t1140'
• -'attack.t1059.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains: '::FromBase64String('
  condition:selection
Falsepositives:
  -Administrative script libraries
Level: high