Query: detect Detects suspicious PowerShell invocation command parameters in logs
Matching passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Invocations - Generic id: ed965133-513f-41d9-a441-e38076a0798f related: - id: 3d304fda-78aa-43ed-975c-d740798a49c1 type: derived - id: bbb80e91-5746-4fbe-8898-122e2cafdbf4 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research author: Florian Roth (Nextron Systems) date: 2017-03-12 modified: 2023-01-03 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_encoded: ScriptBlockText|contains: - ' -enc ' - ' -EncodedCommand ' - ' -ec ' selection_hidden: ScriptBlockText|contains: - ' -w hidden ' - ' -window hidden ' - ' -windowstyle hidden ' - ' -w 1 ' selection_noninteractive: ScriptBlockText|contains: - ' -noni ' - ' -noninteractive ' condition: all of selection* falsepositives: - Very special / sneaky PowerShell scripts level: high
Near-miss passage: Sigma rule: Detects execution of different log query utilities and commands to search and dump the content of specific event logs or. Logsource: windows / process_creation. Rule: title: Potentially Suspicious EventLog Recon Activity Using Log Query Utilities id: beaa66d6-aa1b-4e3c-80f5-e0145369bfaf related: - id: 9cd55b6c-430a-4fa9-96f4-7cadf5229e9f type: derived status: test description: 'Detects execution of different log query utilities and commands to search and dump the content of specific event logs or look for specific event IDs. This technique is used by threat actors in order to extract sensitive information from events logs such as usernames, IP addresses, hostnames, etc. ' references: - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html - https://thedfirreport.com/2023/10/30/netsupport-intrusion-results-in-domain-compromise/ - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a - https://www.group-ib.com/blog/apt41-world-tour-2021/ - https://labs.withsecure.com/content/dam/labs/docs/f-secureLABS-tlp-white-lazarus-threat-intel-report2.pdf - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-eventlog?view=powershell-5.1 - http://www.solomonson.com/posts/2010-07-09-reading-eventviewer-command-line/ - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wevtutil - https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today - https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/ - https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ author: Nasreddine Bencherchali (Nextron Systems), X__Junior (Nextron Systems) date: 2022-09-09 modified: 2025-12-02 tags: - attack.credential-access - attack.discovery - attack.t1552 - attack.t1087 logsource: category: process_creation product: windows detection: selection_wmi: CommandLine|contains|all: - Select - Win32_NTLogEvent selection_wevtutil_img: - Image|endswith: \wevtutil.exe - OriginalFileName: wevtutil.exe selection_wevtutil_cli: CommandLine|contains: - ' qe ' - ' query-events ' selection_wmic_img: - Image|endswith: \wmic.exe - OriginalFileName: wmic.exe selection_wmic_cli: CommandLine|contains: ' ntevent' selection_cmdlet: CommandLine|contains: - 'Get-WinEvent ' - 'get-eventlog ' selection_logs_name: CommandLine|contains: - Microsoft-Windows-PowerShell - Microsoft-Windows-Security-Auditing - Microsoft-Windows-TerminalServices-LocalSessionManager - Microsof