Query: alert when Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts
Matching passage: Sigma rule: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts. Logsource: windows / ps_script. Rule: title: Potential PowerShell Obfuscation Using Alias Cmdlets id: 96cd126d-f970-49c4-848a-da3a09f55c55 related: - id: e8314f79-564d-4f79-bc13-fbc0bf2660d8 type: derived status: test description: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts references: - https://github.com/1337Rin/Swag-PSO author: frack113 date: 2023-01-08 modified: 2025-10-22 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - 'Set-Alias ' - 'New-Alias ' filter_main_cim: ScriptBlockText: - Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.. Logsource: windows / process_access. Rule: title: Suspicious Process Access to LSASS with Dbgcore/Dbghelp DLLs id: 9f5c1d59-33be-4e60-bcab-85d2f566effd related: - id: 416bc4a2-7217-4519-8dc7-c3271817f1d5 type: similar status: experimental description: 'Detects suspicious process access to LSASS.exe from processes located in uncommon locations with dbgcore.dll or dbghelp.dll in the call trace. These DLLs contain functions like MiniDumpWriteDump that can be abused for credential dumping purposes. While modern tools like Mimikatz have moved to using ntdll.dll, dbgcore.dll and dbghelp.dll are still used by basic credential dumping utilities and legacy tools for LSASS memory access and process suspension techniques. ' references: - https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html - https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump author: Swachchhanda Shrawan Poudel (Nextron Systems) date: 2025-11-27 tags: - attack.credential-access - attack.defense-impairment - attack.t1003.001 - attack.t1685 logsource: category: process_access product: windows detection: selection_lsass_calltrace: TargetImage|endswith: \lsass.exe CallTrace|contains: - dbgcore.dll - dbghelp.dll selection_susp_location: SourceImage|contains: - :\Perflogs\ - :\Temp\ - :\Users\Public\ - \$Recycle.Bin\ - \AppData\Roaming\ - \Contacts\ - \Desktop\ - \Documents\ - \Downloads\ - \Favorites\ - \Favourites\ - \inetpub\wwwroot\ - \Music\ - \Pictures\ - \Start Menu\Programs\Startup\ - \Users\Default\ - \Videos\ - \Windows\Temp\ condition: all of selection_* falsepositives: - Possibly during software installation or update processes level: high regression_tests_path: regression_data/rules/windows/process_access/proc_access_win_susp_dbgcore_dbghelp_load/info.yml