Query: rule covering Detects Commandlet names and arguments from the Nishang exploitation framework
Matching passage: Sigma rule: Detects Commandlet names and arguments from the Nishang exploitation framework. Logsource: windows / ps_script. Rule: title: Malicious Nishang PowerShell Commandlets id: f772cee9-b7c2-4cb2-8f07-49870adc02e0 status: test description: Detects Commandlet names and arguments from the Nishang exploitation framework references: - https://github.com/samratashok/nishang author: Alec Costello date: 2019-05-16 modified: 2023-01-16 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Add-ConstrainedDelegationBackdoor - Copy-VSS - Create-MultipleSessions - DataToEncode - DNS_TXT_Pwnage - Do-Exfiltration-Dns - Download_Execute - Download-Execute-PS - DownloadAndExtractFromRemoteRegistry - DumpCerts - DumpCreds - DumpHashes - Enable-DuplicateToken - Enable-Duplication - Execute-Command-MSSQL - Execute-DNSTXT-Code - Execute-OnTime - ExetoText - exfill - ExfilOption - FakeDC - FireBuster - FireListener - 'Get-Information ' - Get-PassHints - Get-Web-Credentials - Get-WebCredentials - Get-WLAN-Keys - HTTP-Backdoor - Invoke-AmsiBypass - Invoke-BruteForce - Invoke-CredentialsPhish - Invoke-Decode - Invoke-Encode - Invoke-Interceptor - Invoke-JSRatRegsvr - Invoke-JSRatRundll - Invoke-MimikatzWDigestDowngrade - Invoke-NetworkRelay - Invoke-PowerShellIcmp - Invoke-PowerShellUdp - Invoke-Prasadhak - Invoke-PSGcat - Invoke-PsGcatAgent - Invoke-SessionGopher - Invoke-SSIDExfil - LoggedKeys - Nishang - NotAllNameSpaces - Out-CHM - OUT-DNSTXT - Out-HTA - Out-RundllCommand - Out-SCF - Out-SCT - Out-Shortcut - Out-WebQuery - Out-Word - Parse_Keys - Password-List - Powerpreter - Remove-Persistence - Remove-PoshRat - Remove-Update - Run-EXEonRemote - Set-DCShadowPermissions - Set-RemotePSRemoting - Set-RemoteWMI - Shellcode32 - Shellcode64 - StringtoBase64 - TexttoExe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policie. Logsource: m365 / audit. Rule: title: Azure Login Bypassing Conditional Access Policies id: 13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc status: experimental description: 'Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith. ' author: Josh Nickels, Marius Rothenbücher references: - https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/ - https://github.com/JumpsecLabs/TokenSmith date: 2025-01-08 tags: - attack.privilege-escalation - attack.persistence - attack.initial-access - attack.stealth - attack.t1078 logsource: service: audit product: m365 detection: selection: Operation: UserLoggedIn ApplicationId: 9ba1a5c7-f17a-4de9-a1f1-6178c8d51223 ResultStatus: Success RequestType: Cmsi:Cmsi filter_main_bjectid: ObjectId: 0000000a-0000-0000-c000-000000000000 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high