Detect a hand-rolled character-table encoder in a script block

Siemphony@siemphonymediumT1132.002unverified

Matches PowerShell script-block logging where the recorded script both declares a literal character alphabet — a hand-rolled translation table, since .NET already ships Base64 and hex — and performs a per-character index or bit transform, which is the encode loop AN0927 describes. ScriptBlockText was chosen over the analytic's process_creation and network_connection sources because it is the only field in AN0927 that shows the encoder itself rather than its side effects. The analytic's real observable is a correlation: the encode routine, then egress with an asymmetric bytes_out:bytes_in ratio or fixed-size beacons inside MITRE's TimeWindow. Sigma expresses no ratio, no standard deviation and no join window, so this rule is the single-event precursor only, and the EntropyThreshold and TokenLengthThreshold knobs are left entirely to the analyst. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0326, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

Event| where ((EventID == 4104 and (ScriptBlockText contains "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz" or ScriptBlockText contains "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ" or ScriptBlockText contains "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567" or ScriptBlockText contains "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ" or ScriptBlockText contains "0123456789abcdefghijklmnopqrstuvwxyz")) and (ScriptBlockText contains "-bxor" or ScriptBlockText contains "-band" or ScriptBlockText contains "-shr" or ScriptBlockText contains "-shl" or ScriptBlockText contains ".IndexOf(" or ScriptBlockText contains "ToCharArray()"))

Splunk · SPL

Run this as a search.

index=* ((EventID="4104" AND (ScriptBlockText="*ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz*" OR ScriptBlockText="*abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ*" OR ScriptBlockText="*ABCDEFGHIJKLMNOPQRSTUVWXYZ234567*" OR ScriptBlockText="*0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ*" OR ScriptBlockText="*0123456789abcdefghijklmnopqrstuvwxyz*")) AND (ScriptBlockText="*-bxor*" OR ScriptBlockText="*-band*" OR ScriptBlockText="*-shr*" OR ScriptBlockText="*-shl*" OR ScriptBlockText="*.IndexOf(*" OR ScriptBlockText="*ToCharArray()*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((event.code == 4104 AND (TO_LOWER(powershell.file.script_block_text) LIKE "*abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*abcdefghijklmnopqrstuvwxyz234567*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*0123456789abcdefghijklmnopqrstuvwxyz*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*0123456789abcdefghijklmnopqrstuvwxyz*")) AND (TO_LOWER(powershell.file.script_block_text) LIKE "*-bxor*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-band*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-shr*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*-shl*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*.indexof(*" OR TO_LOWER(powershell.file.script_block_text) LIKE "*tochararray()*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="EventID" type="pcre2">(?i)^4104$</field>    <field name="ScriptBlockText" type="pcre2">(?i)(ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz|abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ|ABCDEFGHIJKLMNOPQRSTUVWXYZ234567|0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ|0123456789abcdefghijklmnopqrstuvwxyz)</field>    <field name="ScriptBlockText" type="pcre2">(?i)(-bxor|-band|-shr|-shl|\.IndexOf\(|ToCharArray\(\))</field>    <description>Detect a hand-rolled character-table encoder in a script block</description>    <mitre>      <id>T1132.002</id>    </mitre>  </rule></group>

At a glance

Logsource: powershell / windows
Level: medium
Category: obfuscated_payloads
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: c2dbc459-235f-4f9f-a464-6bb60fc3fa88

ATT&CKT1132.002

T1132.002Non-Standard Encoding

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonobfuscated payloads

obfuscated payloadsAI draft — unreviewed

01 · What this rule detects

One PowerShell script block that contains both a literal character alphabet and a per-character transform. The pairing is sound reasoning: .NET already ships [Convert]::ToBase64String, so a script that writes out its own character table and then indexes into it or XORs across it is doing by hand what the framework does for free — which is what a C2 encoder looks like. MITRE's AN0927 is a chain: build a custom translation table, then egress with an asymmetric bytes-out:bytes-in ratio or fixed-size beacons inside a TimeWindow. Sigma expresses no ratio, no standard deviation and no join, so this rule is only the first half — the encode routine, on its own, in one event.

02 · Telemetry you need

The logsource is product: windows, service: powershell, copied verbatim
Script Block Logging must be enabled — off by default. The automatic

03 · How the logic works

Three selections, all ANDed:

ScriptBlockText is gated behind EventID: 4104 — the one event in this service where that field exists. Careful field discipline, and worth copying. Now the central problem. The technique is Non-Standard Encoding, and custom_alphabet contains only the standard alphabets: entry 1 is canonical base64, entry 3 is canonical base32, entry 4 is base36. A genuinely arbitrary translation table — a shuffled 64-character alphabet, a rotated one, base85 — satisfies none of them. What the rule catches is a hand-rolled implementation of a standard alphabet, which sits closer to T1132.001. It survives as a .002 rule only because "modified base64" variants (URL-safe, custom padding, swapped +/) keep the A–Z a–z run intact and do match; the defining case for .002 is the one it is blind to. Take the lesson generally: when a selection block enumerates the normal form of a thing, ask whether the technique is defined by abnormality. A second structural point: five alphabet entries are really three. Sigma string matching is case-insensitive, and every backend renders it that way — TO_LOWER in ES|QL, (?i) in the Wazuh pcre2. Entries 1 and 2 collapse to one pattern, and so do 4 and 5; the duplicate LIKE clauses print twice in translations.json. Harmless, but the consequence matters: alphabet case is not available to you as a signal. Attribution: MITRE's knobs are EntropyThreshold, TokenLengthThreshold, BytesOutToInRatio, FixedPacketStdDevThreshold, TimeWindow and KnownLegitEncoders. MITRE supplied no alphabet literals and no operator list; those are the author's. Four of the six are thresholds over payload entropy or flow statistics a 4104 event does not contain, which is why the description leaves them to the analyst instead of faking them.

04 · Common false positives

Signed vendor modules, at shell-startup volume. EventID 4104 logs the
Password generators and token-provisioning tooling: a full alphabet literal
In-house base32/base36 helpers for licence keys and short-URL slugs.

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0326 and never run against a log line. level: medium is an estimate.
tier_2: means measuring the module-import background rate and confirming your pipeline actually routes 4104 to whatever service: powershell resolves to.
tier_3: means restoring AN0927's join — this encode event correlated with a Sysmon EventID 3 egress inside TimeWindow, out:in ratio applied — and by then you would want the alphabet test replaced by an entropy computation, which is the part Sigma cannot carry.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Reassemble by ScriptBlockId before evaluating, if your platform can.
Suppress KnownLegitEncoders by script Path or ScriptBlockId, never by
Drop the two case-duplicate entries; they imply a discrimination Sigma cannot
Know the cheap evasion so you do not oversell the rule: build the table at

Declared by the author

In-house scripts that hand-roll base32 or base36 for licence keys, short-URL slugs or record-ID obfuscation. They declare exactly this kind of alphabet and index into it, and MITRE's KnownLegitEncoders knob exists for precisely these — suppress by script Path or ScriptBlockId rather than by weakening the alphabet list.
Password and passphrase generators, and provisioning tooling that builds random tokens. They carry a full alphabet literal and call ToCharArray(), so all three selections are satisfied; without MITRE's EntropyThreshold and TokenLengthThreshold there is nothing inside a single 4104 event that separates a 16-character password from a 4 KB encoded payload.
Checksum, CRC and simple integrity routines inside signed third-party modules, whose script blocks are logged verbatim when the module is dot- sourced. These use -bxor and -shr against a lookup table and will match if the table happens to be alphabetic.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1132.002, evaluated against their — events.

Share this rule

/u/siemphony/c2dbc459-235f-4f9f-a464-6bb60fc3fa88

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect a hand-rolled character-table encoder in a script block

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it