Query: detect Detects Commandlet names from well-known PowerShell exploitation frameworks in logs
Matching passage: Sigma rule: Detects Commandlet names from well-known PowerShell exploitation frameworks. Logsource: windows / ps_script. Rule: title: Malicious PowerShell Commandlets - ScriptBlock id: 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6 related: - id: 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c type: similar - id: 02030f2f-6199-49ec-b258-ea71b07e03dc type: similar - id: 6d3f1399-a81c-4409-aff3-1ecfe9330baf type: obsolete - id: 83083ac6-1816-4e76-97d7-59af9a9ae46e type: obsolete status: test description: Detects Commandlet names from well-known PowerShell exploitation frameworks references: - https://adsecurity.org/?p=2921 - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - https://github.com/calebstewart/CVE-2021-1675 - https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1 - https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html - https://github.com/HarmJ0y/DAMP - https://github.com/samratashok/nishang - https://github.com/DarkCoderSc/PowerRunAsSystem/ - https://github.com/besimorhino/powercat - https://github.com/Kevin-Robertson/Powermad - https://github.com/adrecon/ADRecon - https://github.com/adrecon/AzureADRecon - https://github.com/The-Viper-One/Invoke-PowerDPAPI/ - https://github.com/Arno0x/DNSExfiltrator/ author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer date: 2017-03-05 modified: 2025-12-10 tags: - attack.execution - attack.discovery - attack.t1482 - attack.t1087 - attack.t1087.001 - attack.t1087.002 - attack.t1069.001 - attack.t1069.002 - attack.t1069 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Add-Exfiltration - Add-Persistence - Add-RegBackdoor - Add-RemoteRegBackdoor - Add-ScrnSave
Near-miss passage: Sigma rule: Detects the execution of 'auditctl' with the '-D' command line parameter, which deletes all configured audit rules and w. Logsource: linux / process_creation. Rule: title: Audit Rules Deleted Via Auditctl id: bed26dea-4525-47f4-b24a-76e30e44ffb0 status: experimental description: 'Detects the execution of ''auditctl'' with the ''-D'' command line parameter, which deletes all configured audit rules and watches on Linux systems. This technique is commonly used by attackers to disable audit logging and cover their tracks by removing monitoring capabilities. Removal of audit rules can significantly impair detection of malicious activities on the affected system. ' references: - https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012 - https://linux.die.net/man/8/auditct author: Mohamed LAKRI date: 2025-10-17 tags: - attack.defense-impairment - attack.t1685.004 logsource: product: linux category: process_creation detection: selection: Image|endswith: /auditctl CommandLine|re: -D condition: selection falsepositives: - An administrator troubleshooting. Investigate all attempts. level: high