Skip to content

Replace CommandLine with real command line arguments #5219

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nasbench merged 2 commits into from
Jun 4, 2025
Merged

Replace CommandLine with real command line arguments #5219

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e42c8a3
Replace CommandLine with real command line arguments
nikstuckenbrock Mar 3, 2025
182fdb3
fix: use both alternatives
phantinuss May 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions rules/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
title: Potential PowerShell Obfuscation Via WCHAR
title: Potential PowerShell Obfuscation Via WCHAR/CHAR
id: e312efd0-35a1-407f-8439-b8d434b438a6
status: test
description: Detects suspicious encoded character syntax often used for defense evasion
references:
- https://twitter.com/0gtweet/status/1281103918693482496
author: Florian Roth (Nextron Systems)
date: 2020-07-09
modified: 2023-01-05
modified: 2025-03-03
tags:
- attack.execution
- attack.t1059.001
Expand All @@ -17,7 +17,9 @@ logsource:
product: windows
detection:
selection:
CommandLine|contains: '(WCHAR)0x'
CommandLine|contains:
- '[char]0x'
- '(WCHAR)0x'
condition: selection
falsepositives:
- Unknown
Expand Down
Loading