Obfuscated command classic channel

A PowerShell command in the CLASSIC Windows PowerShell channel built out of concatenated string fragments — &('ne'+'w-'+'item'), ('h'+'ttp') — rather than written plainly.

Splitting a cmdlet name across a concatenation is not something a person or a script does by accident; its only purpose is to defeat a detection looking for the whole word. Emotet's loader is the canonical example and appears in the benchmark corpus four times, obfuscating new-object, new-item, get-item and invoke-item this way.

This targets the classic channel deliberately. windows.powershell.obfuscated_scriptblock covers script-block logging (4104), which has to be turned on; the classic channel is on by default, and on an older estate it is the only PowerShell record that exists. Its 800 pipeline-execution events carry the command that ran.

• T1027Obfuscated Files or Information· Defense Evasion
• T1059.001Command and Scripting Interpreter: PowerShell· Execution
• T1140Deobfuscate/Decode Files or Information· Defense Evasion

Ordinary scripts concatenate strings constantly — building a path or a message is normal — so the raw signal is weaker than it looks and the value is in WHAT was concatenated.

To confirm: read the command in the event. Fragments that reassemble a CMDLET NAME (&('ne'+'w-'+'object')), a URL, or a path are deliberate evasion; a script joining a folder and a filename is not. Backtick-escaped property names (`"SecURiTypROToCOL"`) and randomly-cased variables in the same command are corroboration — no author writes that way. Then find what the command downloaded or wrote, since the obfuscation is only the wrapper.

Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/obfuscated_powershell_classic_channel.yaml, licensed under the Apache License 2.0.

id: windows.powershell.obfuscated_command_classic_channel
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1027, T1059.001, T1140]
description: |
  A PowerShell command in the CLASSIC `Windows PowerShell` channel built out of
  concatenated string fragments — `&('ne'+'w-'+'item')`, `('h'+'ttp')` — rather than
  written plainly.

  Splitting a cmdlet name across a concatenation is not something a person or a script
  does by accident; its only purpose is to defeat a detection looking for the whole
  word. Emotet's loader is the canonical example and appears in the benchmark corpus
  four times, obfuscating `new-object`, `new-item`, `get-item` and `invoke-item` this
  way.

  This targets the classic channel deliberately. `windows.powershell.obfuscated_scriptblock`
  covers script-block logging (4104), which has to be turned on; the classic channel is
  on by default, and on an older estate it is the only PowerShell record that exists.
  Its 800 pipeline-execution events carry the command that ran.
match:
  source_channel_contains_any: ['Windows PowerShell']
  raw_message_regex: "(?i)('\\s*\\+\\s*'|\"\\s*\\+\\s*\")"
correlation_keys: [hostname, user_name]
false_positive_guidance: |
  Ordinary scripts concatenate strings constantly — building a path or a message is
  normal — so the raw signal is weaker than it looks and the value is in WHAT was
  concatenated.

  To confirm: read the command in the event. Fragments that reassemble a CMDLET NAME
  (`&('ne'+'w-'+'object')`), a URL, or a path are deliberate evasion; a script joining
  a folder and a filename is not. Backtick-escaped property names
  (``"SecURi`T`ypRO`T`oCOL"``) and randomly-cased variables in the same command are
  corroboration — no author writes that way. Then find what the command downloaded or
  wrote, since the obfuscation is only the wrapper.

• Obfuscated scriptblockSeverity high
• Encoded commandSeverity high
• Hidden windowSeverity medium
• Encoded PowerShell CommandSeverity high
• PowerShell Download CradleSeverity high
• PowerShell credential dumpingSeverity critical