From 1fb70e913bdeaf358d07036ea6007dc6482152db Mon Sep 17 00:00:00 2001
From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Date: Wed, 16 Apr 2025 17:18:17 -0300
Subject: [PATCH 1/2] [New Rule] Potential PowerShell Obfuscation via High
 Numeric Character Proportion

---
 ...sh_obfuscation_high_number_proportion.toml | 107 ++++++++++++++++++
 1 file changed, 107 insertions(+)
 create mode 100644 rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml

diff --git a/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml b/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
new file mode 100644
index 00000000000..b5af6ce3e39
--- /dev/null
+++ b/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
@@ -0,0 +1,107 @@
+[metadata]
+creation_date = "2025/04/16"
+integration = ["windows"]
+maturity = "production"
+updated_date = "2025/04/16"
+
+[rule]
+author = ["Elastic"]
+description = """
+dentifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence
+of obfuscated or encoded payloads. This behavior is typical of obfuscation methods involving byte arrays, character code
+manipulation, or embedded encoded strings used to deliver and execute malicious content.
+"""
+from = "now-9m"
+language = "esql"
+license = "Elastic License v2"
+name = "Potential PowerShell Obfuscation via High Numeric Character Proportion"
+risk_score = 21
+rule_id = "f9abcddc-a05d-4345-a81d-000b79aa5525"
+setup = """## Setup
+
+The 'PowerShell Script Block Logging' logging policy must be enabled.
+Steps to implement the logging policy with Advanced Audit Configuration:
+
+```
+Computer Configuration >
+Administrative Templates >
+Windows PowerShell >
+Turn on PowerShell Script Block Logging (Enable)
+```
+
+Steps to implement the logging policy via registry:
+
+```
+reg add "hklm\\SOFTWARE\\Policies\\Microsoft\\Windows\\PowerShell\\ScriptBlockLogging" /v EnableScriptBlockLogging /t REG_DWORD /d 1
+```
+"""
+severity = "low"
+tags = [
+    "Domain: Endpoint",
+    "OS: Windows",
+    "Use Case: Threat Detection",
+    "Tactic: Defense Evasion",
+    "Data Source: PowerShell Logs",
+]
+timestamp_override = "event.ingested"
+type = "esql"
+
+query = '''
+FROM logs-windows.powershell_operational* metadata _id, _version, _index
+| WHERE event.code == "4104"
+
+// Look for scripts with more than 1000 chars that contain a related keyword
+| EVAL script_len = LENGTH(powershell.file.script_block_text)
+| WHERE script_len > 1000
+
+// Replace string format expressions with 🔥 to enable counting the occurrence of the patterns we are looking for
+// The emoji is used because it's unlikely to appear in scripts and has a consistent character length of 1
+| EVAL replaced_with_fire = REPLACE(powershell.file.script_block_text, """[0-9]""", "🔥")
+
+// Count the occurrence of numbers and their proportion to the total chars in the script
+| EVAL special_count = script_len - LENGTH(REPLACE(replaced_with_fire, "🔥", ""))
+| EVAL proportion = special_count::double / script_len::double
+
+// Keep the fields relevant to the query, although this is not needed as the alert is populated using _id
+| KEEP special_count, script_len, proportion, replaced_with_fire, powershell.file.script_block_text, powershell.file.script_block_id, file.path, powershell.sequence, powershell.total, _id, _index, host.name, agent.id, user.id
+
+// Filter for scripts with a 25%+ proportion of numbers
+| WHERE proportion > 0.25
+'''
+
+
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1027"
+name = "Obfuscated Files or Information"
+reference = "https://attack.mitre.org/techniques/T1027/"
+
+[[rule.threat.technique]]
+id = "T1140"
+name = "Deobfuscate/Decode Files or Information"
+reference = "https://attack.mitre.org/techniques/T1140/"
+
+
+[rule.threat.tactic]
+id = "TA0005"
+name = "Defense Evasion"
+reference = "https://attack.mitre.org/tactics/TA0005/"
+[[rule.threat]]
+framework = "MITRE ATT&CK"
+[[rule.threat.technique]]
+id = "T1059"
+name = "Command and Scripting Interpreter"
+reference = "https://attack.mitre.org/techniques/T1059/"
+[[rule.threat.technique.subtechnique]]
+id = "T1059.001"
+name = "PowerShell"
+reference = "https://attack.mitre.org/techniques/T1059/001/"
+
+
+
+[rule.threat.tactic]
+id = "TA0002"
+name = "Execution"
+reference = "https://attack.mitre.org/tactics/TA0002/"
+

From 2a06a24e93d03c424c61b4ba4a58b9af1e4764b8 Mon Sep 17 00:00:00 2001
From: Jonhnathan <26856693+w0rk3r@users.noreply.github.com>
Date: Wed, 16 Apr 2025 17:20:45 -0300
Subject: [PATCH 2/2] Update
 defense_evasion_posh_obfuscation_high_number_proportion.toml

---
 ...defense_evasion_posh_obfuscation_high_number_proportion.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml b/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
index b5af6ce3e39..7e6ad3e35bf 100644
--- a/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
+++ b/rules/windows/defense_evasion_posh_obfuscation_high_number_proportion.toml
@@ -7,7 +7,7 @@ updated_date = "2025/04/16"
 [rule]
 author = ["Elastic"]
 description = """
-dentifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence
+Identifies PowerShell scripts with a disproportionately high number of numeric characters, often indicating the presence
 of obfuscated or encoded payloads. This behavior is typical of obfuscation methods involving byte arrays, character code
 manipulation, or embedded encoded strings used to deliver and execute malicious content.
 """