Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image

Title: Potential CommandLine Obfuscation Using Unicode Characters From Suspicious Image
Status: test
Description:Detects potential commandline obfuscation using unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
References:
  -https://www.wietzebeukema.nl/blog/windows-command-line-obfuscation
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1027/T1027.md#atomic-test-6---dlp-evasion-via-sensitive-data-in-vba-macro-over-http
Author: frack113, Florian Roth (Nextron Systems), Josh Nickels
Date: 2024-09-02
modified:2025-05-30
Tags:

• -'attack.stealth'
• -'attack.t1027'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    Image|endswith:
      -'\cmd.exe'
      -'\cscript.exe'
      -'\powershell.exe'
      -'\powershell_ise.exe'
      -'\pwsh.exe'
      -'\wscript.exe'

    OriginalFileName:
      -'Cmd.EXE'
      -'cscript.exe'
      -'PowerShell.EXE'
      -'PowerShell_ISE.EXE'
      -'pwsh.dll'
      -'wscript.exe'

  selection_special_chars:
    CommandLine|contains:
      -'ˣ'
      -'˪'
      -'ˢ'
      -'∕'
      -'⁄'
      -'―'
      -'—'
      -' '
      -'¯'
      -'®'
      -'¶'
      -'⠀'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high