Query: detect Detects suspicious PowerShell invocation command parameters in logs
Matching passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Invocations - Specific id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 type: similar - id: 536e2947-3729-478c-9903-745aaffe60d2 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2017-03-05 modified: 2025-02-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_convert_b64: ScriptBlockText|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg_selection: ScriptBlockText|contains|all: - powershell - reg - add ScriptBlockText|contains: - \software\microsoft\windows\currentversion\run - \software\wow6432node\microsoft\windows\currentversion\run - \software\microsoft\windows\currentversion\policies\explorer\run selection_webclient_selection: ScriptBlockText|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: ScriptBlockText|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection.. Logsource: windows / process_creation. Rule: title: Suspicious Child Process Of SQL Server id: 869b9ca7-9ea2-4a5a-8325-e80e62f75445 related: - id: 344482e4-a477-436c-aa70-7536d18a48c7 type: obsolete status: test description: Detects suspicious child processes of the SQLServer process. This could indicate potential RCE or SQL Injection. references: - Internal Research author: FPT.EagleEye Team, wagga date: 2020-12-11 modified: 2023-05-04 tags: - attack.t1505.003 - attack.t1190 - attack.initial-access - attack.persistence - attack.privilege-escalation logsource: category: process_creation product: windows detection: selection: ParentImage|endswith: \sqlservr.exe Image|endswith: - \bash.exe - \bitsadmin.exe - \cmd.exe - \netstat.exe - \nltest.exe - \ping.exe - \powershell.exe - \pwsh.exe - \regsvr32.exe - \rundll32.exe - \sh.exe - \systeminfo.exe - \tasklist.exe - \wsl.exe filter_optional_datev: ParentImage|startswith: C:\Program Files\Microsoft SQL Server\ ParentImage|endswith: DATEV_DBENGINE\MSSQL\Binn\sqlservr.exe Image: C:\Windows\System32\cmd.exe CommandLine|startswith: '"C:\Windows\system32\cmd.exe" ' condition: selection and not 1 of filter_optional_* level: high