Query: Sigma YAML for windows / ps_script
Matching passage: Sigma rule: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts. Logsource: windows / ps_script. Rule: title: Potential PowerShell Obfuscation Using Alias Cmdlets id: 96cd126d-f970-49c4-848a-da3a09f55c55 related: - id: e8314f79-564d-4f79-bc13-fbc0bf2660d8 type: derived status: test description: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts references: - https://github.com/1337Rin/Swag-PSO author: frack113 date: 2023-01-08 modified: 2025-10-22 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - 'Set-Alias ' - 'New-Alias ' filter_main_cim: ScriptBlockText: - Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low
Near-miss passage: Sigma rule: Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will. Logsource: windows / registry_set. Rule: title: Potential Registry Persistence Attempt Via DbgManagedDebugger id: 9827ae57-3802-418f-994b-d5ecf5cd974b status: test description: Detects the addition of the "Debugger" value to the "DbgManagedDebugger" key in order to achieve persistence. Which will get invoked when an application crashes references: - https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/ - https://github.com/last-byte/PersistenceSniper author: frack113 date: 2022-08-07 modified: 2023-08-17 tags: - attack.privilege-escalation - attack.persistence - attack.execution - attack.stealth - attack.t1574 logsource: category: registry_set product: windows detection: selection: TargetObject|endswith: \Microsoft\.NETFramework\DbgManagedDebugger filter: Details: '"C:\Windows\system32\vsjitdebugger.exe" PID %d APPDOM %d EXTEXT "%s" EVTHDL %d' condition: selection and not filter falsepositives: - Legitimate use of the key to setup a debugger. Which is often the case on developers machines level: medium