Query: Sigma rule for Detects the creation of known offensive powershell scripts used for exploitation
Matching passage: Sigma rule: Detects the creation of known offensive powershell scripts used for exploitation. Logsource: windows / file_event. Rule: title: Malicious PowerShell Scripts - FileCreation id: f331aa1f-8c53-4fc3-b083-cc159bc971cb related: - id: 41025fd7-0466-4650-a813-574aaacbe7f4 type: similar status: test description: Detects the creation of known offensive powershell scripts used for exploitation references: - https://github.com/PowerShellMafia/PowerSploit - https://github.com/NetSPI/PowerUpSQL - https://github.com/CsEnox/EventViewer-UACBypass - https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu - https://github.com/nettitude/Invoke-PowerThIEf - https://github.com/S3cur3Th1sSh1t/WinPwn - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - https://github.com/HarmJ0y/DAMP - https://github.com/samratashok/nishang - https://github.com/DarkCoderSc/PowerRunAsSystem/ - https://github.com/besimorhino/powercat - https://github.com/Kevin-Robertson/Powermad - https://github.com/adrecon/ADRecon - https://github.com/adrecon/AzureADRecon - https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1 - https://github.com/The-Viper-One/Invoke-PowerDPAPI/ - https://github.com/Arno0x/DNSExfiltrator/ author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein date: 2018-04-07 modified: 2025-12-10 tags: - attack.execution - attack.t1059.001 logsource: category: file_event product: windows detection: selection_generic: TargetFilename|endswith: - \Add-ConstrainedDelegationBackdoor.ps1 - \Add-Exfiltration.ps1 - \Add-Persistence.ps1 - \Add-RegBackdoor.ps1 - \Add-RemoteRegBackdoor.ps1 - \Add-ScrnSaveBackdoor.ps1 - \ADRecon.ps1 - \AzureADRecon.ps1 - \BadSuccessor.ps1 - \Check-VM.ps1 - \ConvertTo-ROT13.ps1 - \Copy-VSS.ps1 - \Create-MultipleSessions.ps1 - \DNS_TXT_Pwnage.ps1 - \dnscat2.ps1 - \Do-Exfiltration.ps1 - \DomainPasswordSpray.ps1 - \Download_
Near-miss passage: Sigma rule: Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be instal. Logsource: linux / auditd. Rule: title: Clipboard Collection with Xclip Tool - Auditd id: 214e7e6c-f21b-47ff-bb6f-551b2d143fcf status: test description: 'Detects attempts to collect data stored in the clipboard from users with the usage of xclip tool. Xclip has to be installed. Highly recommended using rule on servers, due to high usage of clipboard utilities on user workstations. ' references: - https://linux.die.net/man/1/xclip - https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/ author: Pawel Mazur date: 2021-09-24 modified: 2022-11-26 tags: - attack.collection - attack.t1115 logsource: product: linux service: auditd detection: selection: type: EXECVE a0: xclip a1: - -selection - -sel a2: - clipboard - clip a3: -o condition: selection falsepositives: - Legitimate usage of xclip tools level: low