Merge pull request SigmaHQ#4048 from YamatoSecurity/update-powershell…

…-usage-of-base64-IEX added other potential IEX strings
SavinSpring · Feb 18, 2023 · e327427 · e327427
2 parents db23238 + 9c673bb
commit e327427
Showing 1 changed file with 7 additions and 1 deletion.
diff --git a/rules/windows/process_creation/proc_creation_win_powershell_base64_iex.yml b/rules/windows/process_creation/proc_creation_win_powershell_base64_iex.yml
@@ -4,7 +4,7 @@ status: test
 description: Detects usage of a base64 encoded "IEX" string in a process command line
 author: Florian Roth (Nextron Systems)
 date: 2019/08/23
-modified: 2023/01/30
+modified: 2023/02/18
 tags:
     - attack.execution
     - attack.t1059.001
@@ -18,6 +18,12 @@ detection:
             - 'iex (['
             - 'iex (New'
             - 'IEX (New'
+            - 'IEX(['
+            - 'iex(['
+            - 'iex(New'
+            - 'IEX(New'
+            - "IEX(('"
+            - "iex(('"
         # UTF16 LE
         - CommandLine|contains:
             - 'SQBFAFgAIAAoAFsA'