# SIGS: ET HUNTING Possible Obfuscated PowerShell Script Download

**URL:** <https://community.emergingthreats.net/t/sigs-et-hunting-possible-obfuscated-powershell-script-download/2739>\
**Category:** Rule Signatures\
**Created:** [May 16, 2025, 10:07am UTC](https://community.emergingthreats.net/t/sigs-et-hunting-possible-obfuscated-powershell-script-download/2739 "2025-05-16T10:07:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![kevross33](https://avatars.discourse-cdn.com/v4/letter/k/82dd89/32.png) [@kevross33](https://community.emergingthreats.net/u/kevross33)\
**Post date:** [May 16, 2025, 10:07am UTC](https://community.emergingthreats.net/t/sigs-et-hunting-possible-obfuscated-powershell-script-download/2739/1 "2025-05-16T10:07:46Z")

</div>

Hi,

Some experimental sigs looking for obfuscation techniques in PS1 downloads. They often start with variable $. Good examples here [MintsLoader Malware Analysis: Multi-Stage Loader Used by TAG-124 and SocGholish](https://www.recordedfuture.com/research/uncovering-mintsloader-with-recorded-future-malware-intelligence-hunting).

Seen in LUMMA distribution too where one was a 9MB PowerShell script (SHA256 bb76c7c0bd9505daf4b91971af20915af9ef2112d664fbe1c30bd097601041f2 [&nbsp;bb76c7c0bd9505daf4b91971af20915af9ef2112d664fbe1c30bd097601041f2 | Triage](https://tria.ge/250414-sga49s1td1/behavioral1)) that loads embedded (and obfuscated/encrypted) LUMMA payload into memory.

alert tcp $EXTERNAL\_NET $HTTP\_PORTS → $HOME\_NET any (msg:“ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive CHAR”; flow:established,to\_client; content:“$”; http\_client\_body; depth:1; content:“[CHAR”; http\_client\_body; nocase; distance:0; content:“[CHAR”; http\_client\_body; nocase; distance:0; content:“[CHAR”; http\_client\_body; nocase; distance:0; content:“[CHAR”; http\_client\_body; nocase; distance:0; classtype:bad-unknown; sid:134201; rev:1;)  
alert tcp $EXTERNAL\_NET $HTTP\_PORTS → $HOME\_NET any (msg:“ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M1”; flow:established,to\_client; content:“$”; http\_client\_body; depth:1; content:“|27|+|27|”; http\_client\_body; distance:0; content:“|27|+|27|”; http\_client\_body; distance:0; content:“|27|+|27|”; http\_client\_body; distance:0; content:“|27|+|27|”; http\_client\_body; distance:0; classtype:bad-unknown; sid:134202; rev:1;)  
alert tcp $EXTERNAL\_NET $HTTP\_PORTS → $HOME\_NET any (msg:“ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M2”; flow:established,to\_client; content:“$”; http\_client\_body; depth:1; content:“|27| + |27|”; http\_client\_body; distance:0; content:“|27| + |27|”; http\_client\_body; distance:0; content:“|27| + |27|”; http\_client\_body; distance:0; content:“|27| + |27|”; http\_client\_body; distance:0; classtype:bad-unknown; sid:134203; rev:1;)  
alert tcp $EXTERNAL\_NET $HTTP\_PORTS → $HOME\_NET any (msg:“ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M3”; flow:established,to\_client; content:“$”; http\_client\_body; depth:1; content:“|22|+|22|”; http\_client\_body; distance:0; content:“|22|+|22|”; http\_client\_body; distance:0; content:“|22|+|22|”; http\_client\_body; distance:0; content:“|22|+|22|”; http\_client\_body; distance:0; classtype:bad-unknown; sid:134204; rev:1;)  
alert tcp $EXTERNAL\_NET $HTTP\_PORTS → $HOME\_NET any (msg:“ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M4”; flow:established,to\_client; content:“$”; http\_client\_body; depth:1; content:“|22| + |22|”; http\_client\_body; distance:0; content:“|22| + |22|”; http\_client\_body; distance:0; content:“|22| + |22|”; http\_client\_body; distance:0; content:“|22| + |22|”; http\_client\_body; distance:0; classtype:bad-unknown; sid:134205; rev:1;)

Kind Regards,  
Kevin

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [May 19, 2025, 4:47pm UTC](https://community.emergingthreats.net/t/sigs-et-hunting-possible-obfuscated-powershell-script-download/2739/2 "2025-05-19T16:47:21Z")

</div>

Thanks for sharing @kevross33! I’ll take a look and get these in today’s release!

- Isaac

---

<div class="post-metadata">

**Author:** ![ishaughnessy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.emergingthreats.net/ishaughnessy/32/491_2.png) [@ishaughnessy](https://community.emergingthreats.net/u/ishaughnessy)\
**Post date:** [May 19, 2025, 11:27pm UTC](https://community.emergingthreats.net/t/sigs-et-hunting-possible-obfuscated-powershell-script-download/2739/3 "2025-05-19T23:27:01Z")

</div>

Thanks again @kevross33 !

````2062456
2062457 - ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M1
2062458 - ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M2
2062459 - ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M3
2062460 - ET HUNTING Possible Obfuscated PowerShell Script Download - Excessive Split String M4```
````