Query: detect Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework in logs
Matching passage: Sigma rule: Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework. Logsource: windows / ps_script. Rule: title: Potential Suspicious PowerShell Keywords id: 1f49f2ab-26bc-48b3-96cc-dcffbc93eadf status: test description: Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework references: - https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462 - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1 - https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1 - https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7 author: Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup) date: 2019-02-11 modified: 2023-04-21 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - System.Reflection.Assembly.Load($ - '[System.Reflection.Assembly]::Load($' - '[Reflection.Assembly]::Load($' - System.Reflection.AssemblyName - Reflection.Emit.AssemblyBuilderAccess - Reflection.Emit.CustomAttributeBuilder - Runtime.InteropServices.UnmanagedType - Runtime.InteropServices.DllImportAttribute - SuspendThread - rundll32 condition: selection falsepositives: - Unknown level: medium
Near-miss passage: Sigma rule: Identifies when a Azure Kubernetes network policy is modified or deleted.. Logsource: azure / activitylogs. Rule: title: Azure Kubernetes Network Policy Change id: 08d6ac24-c927-4469-b3b7-2e422d6e3c43 status: test description: Identifies when a Azure Kubernetes network policy is modified or deleted. references: - https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes - https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/ - https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1 author: Austin Songer @austinsonger date: 2021-08-07 modified: 2022-08-23 tags: - attack.impact - attack.credential-access - attack.t1485 - attack.t1496 - attack.t1489 logsource: product: azure service: activitylogs detection: selection: operationName: - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/NETWORKING.K8S.IO/NETWORKPOLICIES/DELETE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/WRITE - MICROSOFT.KUBERNETES/CONNECTEDCLUSTERS/EXTENSIONS/NETWORKPOLICIES/DELETE condition: selection falsepositives: - Network Policy being modified and deleted may be performed by a system administrator. Verify whether the user identity, user agent, and/or hostname should be making changes in your environment. - Network Policy being modified and deleted from unfamiliar users should be investigated. If known behavior is causing false positives, it can be exempted from the rule. level: medium