Obfuscated command line via caret escaping or string splicing

Siemphony@siemphonymediumT1027.010unverified

AN1394 asks for "excessive escape characters, base64 encoding, command concatenation, or outlier command length and entropy" on a single 4688 record, and this rule takes the three of those four that are actual string shapes rather than a statistic: `CommandLineEntropyThreshold` and `SuspiciousCharacterCount` are both a measurement over the whole string, and lib/sigma has no entropy or length function, so neither knob can be applied as MITRE defines it. In its place, three concrete constructions the technique's own description names are matched directly. `selection_encoded` is `-EncodedCommand`/`-enc` on a PowerShell host process — the base64 leg, and the one MITRE calls out first, standing in for `CommandLineEntropyThreshold` because the flag is a reliable proxy for a high-entropy blob even though the blob's entropy itself is unmeasured. `selection_caret` is `SuspiciousCharacterCount` made concrete: five or more `^`-escaped characters in a row, the shape produced by `p^o^w^e^r^s^h^e^l^l` or `c^m^d`, a cmd.exe evasion old enough to predate this ATT&CK release. `selection_concat` matches the technique description's own worked example — two double-quoted fragments joined by `+`, as in `"Wor"+"d.Application"` — which is string-splitting obfuscation regardless of which interpreter runs it. The brief maps Security 4688 onto Sigma's `process_creation` category, which is Sysmon-shaped; this rule is written in that vocabulary (`Image`, `CommandLine`), so a raw 4688 feed needs `NewProcessName` mapped to `Image` before it applies, and 4688 itself needs *Audit Process Creation* plus the separate *Include command line in process creation events* policy — neither is on by default or in the CIS baseline, and without the command-line policy every event arrives with an empty `CommandLine` and this rule silently matches nothing. `TimeWindow`, correlating the obfuscated command to a later child process or file write, is not attempted — lib/sigma has no timeframe construct. The inline-string decode this rule targets is deliberately distinct from T1027.013, which covers an encoded or encrypted *file* read from disk; `selection_encoded` here fires on the flag alone with no file argument required. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0505, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "-enc" or ProcessCommandLine contains "/enc" or ProcessCommandLine contains "–enc" or ProcessCommandLine contains "—enc" or ProcessCommandLine contains "―enc" or ProcessCommandLine contains "-EncodedCommand" or ProcessCommandLine contains "/EncodedCommand" or ProcessCommandLine contains "–EncodedCommand" or ProcessCommandLine contains "—EncodedCommand" or ProcessCommandLine contains "―EncodedCommand")) or ProcessCommandLine matches regex "(?i)(\\^[A-Za-z]){5,}" or ProcessCommandLine matches regex "(?i)\"[^\"]{1,40}\"\\s*\\+\\s*\"[^\"]{1,40}\"")

Splunk · SPL

Run this as a search.

index=* | where (((match(Image, "(?i)\\\\powershell\\.exe$") OR match(Image, "(?i)\\\\pwsh\\.exe$")) AND (match(CommandLine, "(?i)-enc") OR match(CommandLine, "(?i)/enc") OR match(CommandLine, "(?i)–enc") OR match(CommandLine, "(?i)—enc") OR match(CommandLine, "(?i)―enc") OR match(CommandLine, "(?i)-EncodedCommand") OR match(CommandLine, "(?i)/EncodedCommand") OR match(CommandLine, "(?i)–EncodedCommand") OR match(CommandLine, "(?i)—EncodedCommand") OR match(CommandLine, "(?i)―EncodedCommand"))) OR match(CommandLine, "(\\^[A-Za-z]){5,}") OR match(CommandLine, "\"[^\"]{1,40}\"\\s*\\+\\s*\"[^\"]{1,40}\""))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 3 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(-enc|/enc|–enc|—enc|―enc|-EncodedCommand|/EncodedCommand|–EncodedCommand|—EncodedCommand|―EncodedCommand)</field>    <description>Obfuscated command line via caret escaping or string splicing (1/3)</description>    <mitre>      <id>T1027.010</id>    </mitre>  </rule>   <rule id="100001" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(\^[A-Za-z]){5,}</field>    <description>Obfuscated command line via caret escaping or string splicing (2/3)</description>    <mitre>      <id>T1027.010</id>    </mitre>  </rule>   <rule id="100002" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)&quot;[^&quot;]{1,40}&quot;\s*\+\s*&quot;[^&quot;]{1,40}&quot;</field>    <description>Obfuscated command line via caret escaping or string splicing (3/3)</description>    <mitre>      <id>T1027.010</id>    </mitre>  </rule></group>

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. ES|QL RLIKE uses Lucene regexp syntax, which has no case-insensitive flag, and Sigma regexes are case-insensitive. Use |contains/|startswith/|endswith, or write the ES|QL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_creation / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 8f30bca2-dc70-4991-8b5a-991dcf7dd7c0

ATT&CKT1027.010

T1027.010Command Obfuscation

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

Three concrete command-line obfuscation shapes AN1394's description names: a base64-encoded PowerShell payload passed via -EncodedCommand/-enc, caret-escaped tokens (the p^o^w^e^r^s^h^e^l^l cmd.exe evasion), and double-quoted string concatenation used to splice a command from fragments (MITRE's own example, "Wor"+"d.Application"). It does not attempt to measure overall command entropy or length — those are the fourth signal AN1394 names, and neither is achievable in this rule's logic.

02 · Telemetry you need

Security EventID 4688, mapped into Sigma's process_creation vocabulary (Image, CommandLine) — the brief maps 4688 onto this Sysmon-shaped category, so a raw 4688 feed needs NewProcessName mapped to Image before this rule applies. 4688 itself needs Audit Process Creation plus the separate Include command line in process creation events policy; without the second, CommandLine arrives empty and the rule silently matches nothing rather than warning you it's blind.

03 · How the logic works

Three independent selections under condition: 1 of selection*. selection_encoded requires Image ending in \powershell.exe or \pwsh.exe AND CommandLine containing -enc or -EncodedCommand (windash-aware). selection_caret is a regex for five-or-more repetitions of ^-then-letter, the shape produced by caret-escaping every character. selection_concat matches two double-quoted fragments, up to 40 characters each, joined by +. These three stand in for MITRE's CommandLineEntropyThreshold and SuspiciousCharacterCount knobs, which lib/sigma cannot evaluate directly — it has no entropy or length function — so named string shapes replace a statistic MITRE specifies but this pipeline can't compute.

04 · Common false positives

The four falsepositives are the reason level is medium, not higher: enterprise deployment tooling (SCCM, Intune, GPO logon scripts, CI/CD runners) routinely passes -EncodedCommand to dodge cross-shell quoting problems, and is explicitly called out as the highest-volume match in most estates; legacy VBScript/batch scripts build COM automation strings by ordinary (if dated) concatenation with no evasive intent; installer tooling (WiX, InstallShield, older NSIS wrappers) caret-escapes defensively whether or not escaping is required; and public atomic-test/training samples get run verbatim on analyst and lab machines, reproducing all three shapes on purpose.

05 · Detection maturity

tier_1: This rule has never been executed against a log line and sits at the lowest DeBMM maturity tier by construction. It is a shape-matching scaffold built from strings MITRE names in AN1394's description, not a validated detection, and every falsepositive and threshold above is an untested estimate. It needs a run against real telemetry, tuning against actual deployment-tooling volume, and human review before it is trusted for anything beyond a starting point.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

selection_encoded alone accounts for most of the expected noise, so the first lever is scoping it away from known deployment paths and service accounts, or splitting it into its own lower-level rule while leaving selection_caret/selection_concat at medium. The five-repeat threshold in the caret regex and the 40-character fragment cap in the concat regex are this pipeline's own choices, populated in place of MITRE's SuspiciousCharacterCount knob — MITRE names the mechanism, not a number — so they are the first thing to loosen or tighten against real logon-script and installer volume. The analytic's TimeWindow element, correlating an obfuscated command to a later child process or file write, is not attempted here at all since lib/sigma has no timeframe construct; a human would need to add that correlation externally.

Declared by the author

Enterprise PowerShell deployment tooling. SCCM, Intune, GPO logon scripts and CI/CD runners routinely pass -EncodedCommand to avoid multi-layer quoting problems when a script crosses shells or a scheduler, and this is the highest-volume match in most estates, which is why the level is medium rather than high.
Legacy VBScript and batch logon scripts that build COM automation strings by concatenation as ordinary (if dated) programming style, such as CreateObject("Wor" + "d.Application") written by a non-security author with no intent to evade anything.
Installer and packaging tooling — WiX, InstallShield and older NSIS-generated batch wrappers — that caret-escapes every token defensively regardless of whether escaping is actually required, producing the same five-or-more ^-escaped run this rule matches.
Security-awareness and detection-engineering exercises that run canonical obfuscated-PowerShell samples from public trainings and atomic-test repositories, which reproduce this exact shape on analyst and lab workstations.

Noise checkdid not run

The Sigma source did not build into an evaluable rule, so the check did not run. this rule uses a regular expression, which is not evaluated here — an untrusted pattern can be made to run for a very long time

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1027.010, evaluated against their process_creation events.

Share this rule

/u/siemphony/8f30bca2-dc70-4991-8b5a-991dcf7dd7c0

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Obfuscated command line via caret escaping or string splicing

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Wazuh · XML rule

Elastic · ES|QL

Community

Verdicts from engineers who deployed it