Custom byte-level encoding routine run inline against file data

Siemphony@siemphonymediumT1560.003unverified

Matches a shell one-liner that combines a bitwise byte operation with reading or writing file contents — the hand-rolled XOR or stream-cipher routine AN1213 describes as producing archive-like output with no standard archiving utility involved. Archiving utilities and their verbs are absent from the logic because that is T1560.001, and so are the .NET compression and cryptography stream classes, because library-backed archiving is T1560.002; what is left is the raw arithmetic that makes a method custom, which is what this sub-technique is about. The brief maps Security EventID 4688 onto the Sysmon-shaped `process_creation` category, and this rule is written in the Sysmon EventID 1 vocabulary (`Image`, `CommandLine`): the 4688 feed carries the same data under `NewProcessName` and needs a field mapping first, as well as both Audit Process Creation and the separate Include command line in process creation events policy, neither of which is enabled by default or by the CIS baseline. Only inline routines are visible here — a `-EncodedCommand` blob or a routine living in a .ps1 file puts none of these strings on the command line — and the interpreter list is confined to PowerShell because the operators matched are PowerShell syntax, so listing wscript or cscript would add selectors that can never fire. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0438, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "-bxor" or ProcessCommandLine contains "-bnot" or ProcessCommandLine contains "-band" or ProcessCommandLine contains "-shl" or ProcessCommandLine contains "-shr")) and (ProcessCommandLine contains "ReadAllBytes" or ProcessCommandLine contains "WriteAllBytes" or ProcessCommandLine contains "FileStream" or ProcessCommandLine contains "OpenRead" or ProcessCommandLine contains "OpenWrite" or ProcessCommandLine contains "Get-Content" or ProcessCommandLine contains "Set-Content" or ProcessCommandLine contains "-AsByteStream" or ProcessCommandLine contains "-Encoding Byte"))

Splunk · SPL

Run this as a search.

index=* (((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*-bxor*" OR CommandLine="*-bnot*" OR CommandLine="*-band*" OR CommandLine="*-shl*" OR CommandLine="*-shr*")) AND (CommandLine="*ReadAllBytes*" OR CommandLine="*WriteAllBytes*" OR CommandLine="*FileStream*" OR CommandLine="*OpenRead*" OR CommandLine="*OpenWrite*" OR CommandLine="*Get-Content*" OR CommandLine="*Set-Content*" OR CommandLine="*-AsByteStream*" OR CommandLine="*-Encoding Byte*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*-bxor*" OR TO_LOWER(process.command_line) LIKE "*-bnot*" OR TO_LOWER(process.command_line) LIKE "*-band*" OR TO_LOWER(process.command_line) LIKE "*-shl*" OR TO_LOWER(process.command_line) LIKE "*-shr*")) AND (TO_LOWER(process.command_line) LIKE "*readallbytes*" OR TO_LOWER(process.command_line) LIKE "*writeallbytes*" OR TO_LOWER(process.command_line) LIKE "*filestream*" OR TO_LOWER(process.command_line) LIKE "*openread*" OR TO_LOWER(process.command_line) LIKE "*openwrite*" OR TO_LOWER(process.command_line) LIKE "*get-content*" OR TO_LOWER(process.command_line) LIKE "*set-content*" OR TO_LOWER(process.command_line) LIKE "*-asbytestream*" OR TO_LOWER(process.command_line) LIKE "*-encoding byte*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(-bxor|-bnot|-band|-shl|-shr)</field>    <field name="CommandLine" type="pcre2">(?i)(ReadAllBytes|WriteAllBytes|FileStream|OpenRead|OpenWrite|Get-Content|Set-Content|-AsByteStream|-Encoding Byte)</field>    <description>Custom byte-level encoding routine run inline against file data</description>    <mitre>      <id>T1560.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: medium
Category: data_staging_exfil
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: ac389ad6-e0b0-4634-8aa3-c9bf5d2cd6d4

ATT&CKT1560.003

T1560.003Archive via Custom Method

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessondata staging exfil

data staging exfilAI draft — unreviewed

01 · What this rule detects

This rule looks for one Windows process-creation event where PowerShell, a bitwise operator, and byte-level file I/O all appear on the same command line — the signature of a hand-rolled XOR or stream-cipher routine standing in for a real archiver. The rule title calls this out precisely: "Custom byte-level encoding routine run inline against file data." It deliberately excludes archive utilities (that's T1560.001) and .NET compression/crypto stream classes (T1560.002), leaving only the raw arithmetic that makes a method "custom" under T1560.003.

02 · Telemetry you need

The logsource is category: process_creation, product: windows — Sysmon Event ID 1, which needs CommandLine populated. The brief also lists Security EventID 4688 against this same analytic (AN1213), but 4688 carries the command line under NewProcessName/CommandLine in a different shape and needs a field mapping before it can feed this rule as written — plus Audit Process Creation and the separate "Include command line in process creation events" policy, neither on by default. Don't assume 4688 is a drop-in substitute for Sysmon here.

03 · How the logic works

Three selections, all ANDed together — nothing fires on a partial match: - selection_shell: Image|endswith \powershell.exe or \pwsh.exe - selection_bitwise: CommandLine|contains one of -bxor, -bnot, -band, -shl, -shr - selection_file_io: CommandLine|contains one of ReadAllBytes, WriteAllBytes, FileStream, OpenRead, OpenWrite, Get-Content, Set-Content, -AsByteStream, -Encoding Byte condition: selection_shell and selection_bitwise and selection_file_io. This only ever sees the process-creation precursor — a PowerShell invocation whose visible arguments look like byte manipulation. AN1213 actually describes correlating that execution with memory API calls and the creation of a high-entropy file with no standard header; this rule implements none of that correlation. It cannot confirm an archive-like file was ever written — it just flags the command line that could write one.

04 · Common false positives

The rule's own false positives are specific and worth reading in order, because the first is the dominant one: in-house scripts that read a file with Get-Content/ReadAllBytes and apply -bxor/-band before writing it back — checksum helpers, binary patching, licence/header tools — "is the most common way the rule fires and nothing in the event separates it from staging for exfiltration." Installers unpacking an XOR-obfuscated embedded payload, log/telemetry converters normalizing binary files on a schedule, and malware-analysis workstations round out the list. None of these are edge cases; they're routine engineering and ops work.

05 · Detection maturity

tier_1: UNVERIFIED — lowest tier. This rule was authored from MITRE's DET0438/ AN1213 scaffold and has never been run against a single log line. No false-positive rate, no true-positive count, and no tuning here is backed by observed data; treat every claim above as a hypothesis to test against your own environment, not a result.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

AN1213 names three tuning knobs — EntropyThreshold, AllowedProcesses, TimeWindow — but MITRE only names the knobs; this rule implements none of them. There's no entropy check on the output file, no allowlist for the FP sources above, and no time-window correlation at all, since the condition is a single-event AND with no aggregation. Adding an AllowedProcesses-style filter (parent process or user context) against the false positives above is the most direct improvement.
Review flagged two coverage gaps worth teaching rather than quietly patching. First, restricting the interpreter to powershell.exe/pwsh.exe and matching literal operator text means a Base64 -EncodedCommand blob or a routine saved to a .ps1 file never puts -bxor/ReadAllBytes on the visible command line — a large share of realistic custom archiving in PowerShell slips past this rule entirely, and the rule's own description says so. Second, AN1213 describes "anomalous script or binary execution" broadly, including CryptoAPI usage, but this rule only matches PowerShell operator syntax — compiled .NET, Python, or C-based custom archivers with identical behavior are completely uncovered. The reviewer's summary: defensible scoping for a CommandLine-only rule, but a narrow, single-language net around a technique that is language-agnostic by definition.

Declared by the author

In-house automation that folds bytes while converting a file — checksum and CRC helpers, binary patching, licence and header manipulation — which reads with ReadAllBytes or Get-Content and applies -bxor or -band before writing the result back. This is the most common way the rule fires and nothing in the event separates it from staging for exfiltration.
Vendor installers, endpoint agent modules and deployment scripts that unpack an embedded, XOR-obfuscated payload to disk during setup; the routine is byte-identical to the malicious one and repeats on every host in a rollout wave.
Telemetry and log converters that read a binary file as a byte stream and mask off flag bits before writing a normalised copy, typically running on a schedule from the same few servers.
Malware analysis, detection engineering and training workstations, where operators run byte-manipulation one-liners against sample files as routine daily work.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1560.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/ac389ad6-e0b0-4634-8aa3-c9bf5d2cd6d4

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Custom byte-level encoding routine run inline against file data

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it