Query: rule covering Detects file execution using the msdeploy.exe lolbin
Matching passage: Sigma rule: Detects file execution using the msdeploy.exe lolbin. Logsource: windows / process_creation. Rule: title: Execute Files with Msdeploy.exe id: 646bc99f-6682-4b47-a73a-17b1b64c9d34 status: test description: Detects file execution using the msdeploy.exe lolbin references: - https://lolbas-project.github.io/lolbas/OtherMSBinaries/Msdeploy/ - https://twitter.com/pabraeken/status/995837734379032576 - https://twitter.com/pabraeken/status/999090532839313408 author: Beyu Denis, oscd.community date: 2020-10-18 modified: 2021-11-27 tags: - attack.stealth - attack.t1218 logsource: category: process_creation product: windows detection: selection: CommandLine|contains|all: - verb:sync - -source:RunCommand - -dest:runCommand Image|endswith: \msdeploy.exe condition: selection falsepositives: - System administrator Usage level: medium
Near-miss passage: Sigma rule: Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter'. Logsource: windows / image_load. Rule: title: PowerShell Core DLL Loaded By Non PowerShell Process id: 092bc4b9-3d1d-43b4-a6b4-8c8acd83522f related: - id: 867613fb-fa60-4497-a017-a82df74a172c type: obsolete - id: fe6e002f-f244-4278-9263-20e4b593827f type: obsolete status: test description: 'Detects loading of essential DLLs used by PowerShell by non-PowerShell process. Detects behavior similar to meterpreter''s "load powershell" extension. ' references: - https://adsecurity.org/?p=2921 - https://github.com/p3nt4/PowerShdll author: Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research) date: 2019-11-14 modified: 2026-07-28 tags: - attack.t1059.001 - attack.execution logsource: category: image_load product: windows detection: selection: - Description: System.Management.Automation - OriginalFileName: System.Management.Automation.dll - ImageLoaded|endswith: - \System.Management.Automation.dll - \System.Management.Automation.ni.dll filter_main_powershell: Image: - C:\Program Files\PowerShell\7-preview\pwsh.exe - C:\Program Files\PowerShell\7\pwsh.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe filter_main_pwsh_preview: Image|contains: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview Image|endswith: \pwsh.exe filter_main_generic: Image: - C:\Windows\System32\dsac.exe - C:\WINDOWS\System32\RemoteFXvGPUDisablement.exe - C:\Windows\System32\runscripthelper.exe - C:\WINDOWS\System32\sdiagnhost.exe - C:\Windows\System32\ServerManager.exe - C:\Windows\System32\SyncAppvPublishingServer.exe - C:\Windows\System32\winrshost.exe - C:\Windows\System32\wsmprovhost.exe - C:\Windows\SysWOW64\winrshost.exe - C:\Windows\SysWOW64\wsmprovhost.exe filter_main_dotnet: Image|startswith: - C:\Windows\Microsoft.NET\Framework\ - C:\Windows\Microsoft.NET\FrameworkArm\ - C:\Windows\Microsoft.NET\FrameworkArm64\ - C:\Windows\Microsoft.NET\Framework64\ Image|endswith: \mscorsvw.exe filter_optional_gethelp: Image|startswith: C:\Program Files\WindowsApps\Microsoft.GetHelp_ Image|endswith: \GetHelp.exe filter_optional_sql_server_mgmt: Image|startswith: - C:\Program Files (x86)\Microsoft SQL Server Management Studio - C:\Program Files\Microsoft SQL Server Management Studio Image|endswith: \IDE\