Query: rule covering Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.
Matching passage: Sigma rule: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.. Logsource: windows / ps_script. Rule: title: PowerView PowerShell Cmdlets - ScriptBlock id: dcd74b95-3f36-4ed9-9598-0490951643aa related: - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d type: similar status: test description: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework. references: - https://powersploit.readthedocs.io/en/stable/Recon/README - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon - https://thedfirreport.com/2020/10/08/ryuks-return - https://adsecurity.org/?p=2277 author: Bhabesh Raj date: 2021-05-18 modified: 2023-11-22 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Export-PowerViewCSV - Find-DomainLocalGroupMember - Find-DomainObjectPropertyOutlier - Find-DomainProcess - Find-DomainShare - Find-DomainUserEvent - Find-DomainUserLocation - Find-ForeignGroup - Find-ForeignUser - Find-GPOComputerAdmin - Find-GPOLocation - Find-InterestingDomain - Find-InterestingFile - Find-LocalAdminAccess - Find-ManagedSecurityGroups - Get-CachedRDPConnection - Get-DFSshare - Get-DomainDFSShare - Get-DomainDNSRecord - Get-DomainDNSZone - Get-DomainFileServer - Get-DomainGPOComputerLocalGroupMapping - Get-DomainGPOLocalGroup - Get-DomainGPOUserLocalGroupMapping - Get-LastLoggedOn - Get-LoggedOnLocal - Get-NetFileServer - Get-NetForest - Get-NetGPOGroup - Get-NetProcess - Get-NetRDPSession - Get-RegistryMountedDrive - Get-RegLoggedOn - Get-WMIRegCachedRDPConnection - Get-WMIRegLastLoggedOn - Get-WMIRegMountedDrive - Get-WMIRegProxy - Invoke-ACLScanner - Invoke-CheckLocalAdminAccess - Invoke-EnumerateLocalAdmin - Invoke-EventHunter - Invoke-FileFinder - Invoke-Kerberoast - Invoke-MapDomainTrust - Invoke-ProcessHunter - Invoke-RevertToSelf - Invoke-ShareFinder - Invoke-UserHunter - Invoke-UserImpersonation - Remove-RemoteConnection - Request-SPNTicket - Resolve-IPAddress condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the f. Logsource: windows / ps_script. Rule: title: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell id: 1b9dc62e-6e9e-42a3-8990-94d7a10007f7 status: test description: Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014 references: - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888 author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community date: 2019-11-08 modified: 2022-12-31 tags: - attack.stealth - attack.t1027 - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_iex: - ScriptBlockText|re: \$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\[ - ScriptBlockText|re: \$ShellId\[\s*\d{1,3}\s*\]\s*\+\s*\$ShellId\[ - ScriptBlockText|re: \$env:Public\[\s*\d{1,3}\s*\]\s*\+\s*\$env:Public\[ - ScriptBlockText|re: \$env:ComSpec\[(\s*\d{1,3}\s*,){2} - ScriptBlockText|re: \*mdr\*\W\s*\)\.Name - ScriptBlockText|re: \$VerbosePreference\.ToString\( condition: selection_iex falsepositives: - Unknown level: high