Query: detection rule: Detects suspicious PowerShell invocation command parameters
Matching passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Invocations - Specific id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 type: similar - id: 536e2947-3729-478c-9903-745aaffe60d2 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2017-03-05 modified: 2025-02-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_convert_b64: ScriptBlockText|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg_selection: ScriptBlockText|contains|all: - powershell - reg - add ScriptBlockText|contains: - \software\microsoft\windows\currentversion\run - \software\wow6432node\microsoft\windows\currentversion\run - \software\microsoft\windows\currentversion\policies\explorer\run selection_webclient_selection: ScriptBlockText|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: ScriptBlockText|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects programs that connect to known malware callback ports based on threat intelligence reports.. Logsource: linux / network_connection. Rule: title: Potentially Suspicious Malware Callback Communication - Linux id: dbfc7c98-04ab-4ab7-aa94-c74d22aa7376 related: - id: 4b89abaa-99fe-4232-afdd-8f9aa4d20382 type: derived status: test description: 'Detects programs that connect to known malware callback ports based on threat intelligence reports. ' references: - https://www.mandiant.com/resources/blog/triton-actor-ttp-profile-custom-attack-tools-detections - https://www.mandiant.com/resources/blog/ukraine-and-sandworm-team - https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html - https://thehackernews.com/2024/01/systembc-malwares-c2-server-analysis.html - https://www.cybereason.com/blog/sliver-c2-leveraged-by-many-threat-actors author: hasselj date: 2024-05-10 tags: - attack.persistence - attack.command-and-control - attack.t1571 logsource: category: network_connection product: linux detection: selection: Initiated: 'true' DestinationPort: - 888 - 999 - 2200 - 2222 - 4000 - 4444 - 6789 - 8531 - 50501 - 51820 filter_main_local_ranges: DestinationIp|cidr: - 127.0.0.0/8 - 10.0.0.0/8 - 172.16.0.0/12 - 192.168.0.0/16 - 169.254.0.0/16 - ::1/128 - fe80::/10 - fc00::/7 condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: high