Query: rule covering Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Matching passage: Sigma rule: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe. Logsource: windows / pipe_created. Rule: title: Alternate PowerShell Hosts Pipe id: 58cb02d5-78ce-4692-b3e1-dce850aae41a related: - id: ac7102b4-9e1e-4802-9b4f-17c5524c015c type: derived status: test description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html - https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton date: 2019-09-12 modified: 2025-10-07 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: pipe_created definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575 detection: selection: PipeName|startswith: \PSHost filter_main_generic: - Image|contains: - :\Program Files\PowerShell\7-preview\pwsh.exe - :\Program Files\PowerShell\7\pwsh.exe - :\Windows\system32\dsac.exe - :\Windows\system32\inetsrv\w3wp.exe - :\Windows\System32\sdiagnhost.exe - :\Windows\system32\ServerManager.exe - :\Windows\system32\wbem\wmiprvse.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\System32\WindowsPowerShell\v1.0\powershell.exe - :\Windows\System32\wsmprovhost.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe - :\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe - Image|contains|all: - C:\Program Files\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe - Image|contains|all: - \AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShellPreview - \pwsh.exe filter_optional_sqlserver: Image|startswith: - C:\Program Files (x86)\ - C:\Program Files\ Image|contains: \Microsoft SQL Server\ Image|endswith: \Tools\Binn\SQLPS.exe filter_optional_azure_connected_machine_agent: Image|startswith: C:\Program Files\AzureConnectedMachineAgent\GCArcService Image|endswith: \GC\gc_worker.exe filter_optional_citrix: Image|startswith: C:\Program Files\Citrix\ filter_optional_exchange: Image|startswith: C:\Program Files\Microsoft\Exchange Se
Near-miss passage: Sigma rule: Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy dat. Logsource: windows / process_creation. Rule: title: Deleted Data Overwritten Via Cipher.EXE id: 4b046706-5789-4673-b111-66f25fe99534 status: test description: 'Detects usage of the "cipher" built-in utility in order to overwrite deleted data from disk. Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources. Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives ' references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1485/T1485.md#atomic-test-3---overwrite-deleted-data-on-c-drive author: frack113 date: 2021-12-26 modified: 2023-02-21 tags: - attack.impact - attack.t1485 logsource: category: process_creation product: windows detection: selection_img: - OriginalFileName: CIPHER.EXE - Image|endswith: \cipher.exe selection_cli: CommandLine|contains: ' /w:' condition: all of selection_* falsepositives: - Unknown level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_cipher_overwrite_deleted_data/info.yml simulation: - type: atomic-red-team name: Overwrite deleted data on C drive technique: T1485 atomic_guid: 321fd25e-0007-417f-adec-33232252be19