Query: Sigma rule for Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process
Matching passage: Sigma rule: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process. Logsource: windows / file_event. Rule: title: PowerShell Module File Created By Non-PowerShell Process id: e3845023-ca9a-4024-b2b2-5422156d5527 status: test description: Detects the creation of a new PowerShell module ".psm1", ".psd1", ".dll", ".ps1", etc. by a non-PowerShell process references: - Internal Research - https://learn.microsoft.com/en-us/powershell/scripting/developer/module/understanding-a-windows-powershell-module?view=powershell-7.3 author: Nasreddine Bencherchali (Nextron Systems) date: 2023-05-09 modified: 2025-10-07 tags: - attack.persistence logsource: category: file_event product: windows detection: selection: TargetFilename|contains: - \WindowsPowerShell\Modules\ - \PowerShell\7\Modules\ filter_main_pwsh: Image|endswith: - :\Program Files\PowerShell\7-preview\pwsh.exe - :\Program Files\PowerShell\7\pwsh.exe - :\Windows\System32\poqexec.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - :\Windows\SysWOW64\poqexec.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_msiexec: Image: - C:\Windows\System32\msiexec.exe - C:\Windows\SysWOW64\msiexec.exe condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed. Logsource: windows / process_creation. Rule: title: Suspicious Group And Account Reconnaissance Activity Using Net.EXE id: d95de845-b83c-4a9a-8a6a-4fc802ebf6c0 status: test description: 'Detects suspicious reconnaissance command line activity on Windows systems using Net.EXE Check if the user that executed the commands is suspicious (e.g. service accounts, LOCAL_SYSTEM) ' references: - https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/ - https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/ - https://research.nccgroup.com/2022/08/19/back-in-black-unlocking-a-lockbit-3-0-ransomware-attack/ author: Florian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems) date: 2019-01-16 modified: 2023-03-02 tags: - attack.discovery - attack.t1087.001 - attack.t1087.002 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: - \net.exe - \net1.exe - OriginalFileName: - net.exe - net1.exe selection_group_root: CommandLine|contains: - ' group ' - ' localgroup ' selection_group_flags: CommandLine|contains: - domain admins - ' administrator' - ' administrateur' - enterprise admins - Exchange Trusted Subsystem - Remote Desktop Users - Utilisateurs du Bureau à distance - Usuarios de escritorio remoto - ' /do' filter_group_add: CommandLine|contains: ' /add' selection_accounts_root: CommandLine|contains: ' accounts ' selection_accounts_flags: CommandLine|contains: ' /do' condition: selection_img and ((all of selection_group_* and not filter_group_add) or all of selection_accounts_*) falsepositives: - Inventory tool runs - Administrative activity level: medium