Query: Sigma YAML for windows / ps_module
Matching passage: Sigma rule: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe. Logsource: windows / ps_module. Rule: title: Alternate PowerShell Hosts - PowerShell Module id: 64e8e417-c19a-475a-8d19-98ea705394cc status: test description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-11 modified: 2025-10-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: '*' filter_powershell: ContextInfo|contains: - = powershell - = C:\Windows\System32\WindowsPowerShell\v1.0\powershell - = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell - = C:/Windows/System32/WindowsPowerShell/v1.0/powershell - = C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell - = \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell - = \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell filter_sdiagnhost: ContextInfo|contains: = C:\WINDOWS\System32\sdiagnhost.exe -Embedding filter_citrix: ContextInfo|contains: ConfigSyncRun.exe filter_adace: ContextInfo|contains: C:\Windows\system32\dsac.exe filter_winrm: ContextInfo|contains: C:\Windows\system32\wsmprovhost.exe -Embedding filter_help_update: Payload|contains: - Update-Help - Failed to update Help for the module condition: selection and not 1 of filter_* falsepositives: - Programs using PowerShell directly without invocation of a dedicated interpreter - MSP Detection Searcher - Citrix ConfigSync.ps1 level: medium
Near-miss passage: Sigma rule: Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePo. Logsource: linux / process_creation. Rule: title: PUA - TruffleHog Execution - Linux id: d7a650c4-226c-451e-948f-cc490db506aa related: - id: 44030449-b0df-4c94-aae1-502359ab28ee type: similar status: experimental description: 'Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously. While it is a legitimate tool, intended for use in CI pipelines and security assessments, It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. ' references: - https://github.com/trufflesecurity/trufflehog - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-09-24 tags: - attack.discovery - attack.credential-access - attack.t1083 - attack.t1552.001 logsource: category: process_creation product: linux detection: selection_img: Image|endswith: /trufflehog selection_cli_platform: CommandLine|contains: - ' docker --image ' - ' Git ' - ' GitHub ' - ' Jira ' - ' Slack ' - ' Confluence ' - ' SharePoint ' - ' s3 ' - ' gcs ' selection_cli_verified: CommandLine|contains: ' --results=verified' condition: selection_img or all of selection_cli_* falsepositives: - Legitimate use of TruffleHog by security teams or developers. level: medium