Command lines that change shape

An attacker controls the command line. Programs accept the same option in several spellings, so a rule written for one spelling misses the others. PowerShell is the common example: -EncodedCommand takes a base64 encoded script, and PowerShell accepts shortened parameter names, so -e, -ec, -enc and -EncodedCommand all work. Windows programs also accept / in place of - for many options.

windash

The windash modifier makes - and / interchangeable (and the en dash, em dash and horizontal bar characters, which some programs also accept):

CommandLine|windash|contains: ' -enc '

matches -enc and /enc . It does not help with the other abbreviations.

re

The re modifier treats the value as a regular expression. In Sigma regular expressions are case-sensitive by default; re|i makes them case-insensitive. Unlike plain values, a regular expression is not anchored: it matches anywhere in the field unless it uses ^ or $.

CommandLine|re|i: '\s[-/](e|ec|en[a-z]*)\s+[a-z0-9+/=]{20,}'

reads: whitespace, then - or /, then e, ec or en followed by letters, then whitespace, then at least 20 base64 characters. Requiring the base64 argument is what separates it from -eq in a script. Regular expressions are harder to read and slower to evaluate in most SIEMs than contains; use them when the alternatives cannot be listed.

base64offset

When the encoded text itself is known, base64offset|contains searches for it inside base64 data. Base64 encodes three bytes at a time, so the same text looks different depending on where it starts; the modifier generates the three possible forms. PowerShell encodes the script as UTF-16LE before base64, so the wide modifier comes first:

CommandLine|wide|base64offset|contains: 'Invoke-Expression'

This finds a known string in an encoded command without decoding it.