Query: rule covering Detects the use of PSAttack PowerShell hack tool
Matching passage: Sigma rule: Detects the use of PSAttack PowerShell hack tool. Logsource: windows / ps_script. Rule: title: PowerShell PSAttack id: b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5 status: test description: Detects the use of PSAttack PowerShell hack tool references: - https://adsecurity.org/?p=2921 author: Sean Metcalf (source), Florian Roth (Nextron Systems) date: 2017-03-05 modified: 2022-12-25 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: PS ATTACK!!! condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects modification of autostart extensibility point (ASEP) in registry.. Logsource: windows / registry_set. Rule: title: CurrentVersion NT Autorun Keys Modification id: cbf93e5d-ca6c-4722-8bea-e9119007c248 related: - id: 17f878b8-9968-4578-b814-c4217fc5768c type: obsolete status: test description: Detects modification of autostart extensibility point (ASEP) in registry. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.001/T1547.001.md - https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns - https://gist.github.com/GlebSukhodolskiy/0fc5fa5f482903064b448890db1eaf9d author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split) date: 2019-10-25 modified: 2025-10-22 tags: - attack.privilege-escalation - attack.persistence - attack.t1547.001 logsource: category: registry_set product: windows detection: selection_nt_current_version_base: TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion selection_nt_current_version: TargetObject|contains: - \Winlogon\VmApplet - \Winlogon\Userinit - \Winlogon\Taskman - \Winlogon\Shell - \Winlogon\GpExtensions - \Winlogon\AppSetup - \Winlogon\AlternateShells\AvailableShells - \Windows\IconServiceLib - \Windows\Appinit_Dlls - \Image File Execution Options - \Font Drivers - \Drivers32 - \Windows\Run - \Windows\Load filter_main_empty: Details: (Empty) filter_main_null: Details: null filter_main_poqexec: Image: C:\Windows\System32\poqexec.exe filter_main_legitimate_subkey: TargetObject|contains: \Image File Execution Options\ TargetObject|endswith: - \DisableExceptionChainValidation - \MitigationOptions filter_main_security_extension_dc: Image: C:\Windows\system32\svchost.exe TargetObject|contains: - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\PreviousPolicyAreas - \Winlogon\GPExtensions\{827D319E-6EAC-11D2-A4EA-00C04F79F83A}\MaxNoGPOListChangesInterval Details: - DWORD (0x00000001) - DWORD (0x00000009) - DWORD (0x000003c0) filter_main_runtimebroker: Image: C:\Windows\System32\RuntimeBroker.exe TargetObject|contains: \runtimebroker.exe\Microsoft.Windows.ShellExperienceHost filter_optional_edge: Image|startswith: C:\Program Files (x86)\Microsoft\Temp\ Image|endswith: \MicrosoftEdgeUpdate.exe filter_optional_avguard: Image|startswith: - C:\Program Files (x86)\Avira\Antivirus\avguard.exe - C:\Program Files\Avira\Antivirus\avguard.exe TargetObject|contains: SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentV