Query: detection rule: Detects scripts or commands that disabled the Powershell command history by removing psreadline module
Matching passage: Sigma rule: Detects scripts or commands that disabled the Powershell command history by removing psreadline module. Logsource: windows / ps_script. Rule: title: Disable Powershell Command History id: 602f5669-6927-4688-84db-0d4b7afb2150 status: test description: Detects scripts or commands that disabled the Powershell command history by removing psreadline module references: - https://twitter.com/DissectMalware/status/1062879286749773824 author: Ali Alwashali date: 2022-08-21 tags: - attack.stealth - attack.t1070.003 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains|all: - Remove-Module - psreadline condition: selection falsepositives: - Legitimate script that disables the command history level: high
Near-miss passage: Sigma rule: Detects an executable, which is not an internet browser or known application, initiating network connections to legit po. Logsource: windows / network_connection. Rule: title: New Connection Initiated To Potential Dead Drop Resolver Domain id: 297ae038-edc2-4b2e-bb3e-7c5fc94dd5c7 related: - id: d7b09985-95a3-44be-8450-b6eadf49833e type: obsolete - id: 8b48ad89-10d8-4382-a546-50588c410f0d type: similar - id: d635249d-86b5-4dad-a8c7-d7272b788586 type: similar - id: 52182dfb-afb7-41db-b4bc-5336cb29b464 type: similar - id: ae02ed70-11aa-4a22-b397-c0d0e8f6ea99 type: similar - id: e0f8ab85-0ac9-423b-a73a-81b3c7b1aa97 type: similar - id: 7b434893-c57d-4f41-908d-6a17bf1ae98f type: similar - id: 8518ed3d-f7c9-4601-a26c-f361a4256a0c type: similar - id: 42a5f1e7-9603-4f6d-97ae-3f37d130d794 type: similar - id: 56454143-524f-49fb-b1c6-3fb8b1ad41fb type: similar - id: b6e04788-29e1-4557-bb14-77f761848ab8 type: similar - id: a0d7e4d2-bede-4141-8896-bc6e237e977c type: similar status: test description: 'Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks. In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected. ' references: - https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/ - https://securelist.com/the-tetrade-brazilian-banking-malware/97779/ - https://blog.bushidotoken.net/2021/04/dead-drop-resolvers-espionage-inspired.html - https://github.com/kleiton0x00/RedditC2 - https://twitter.com/kleiton0x7e/status/1600567316810551296 - https://www.linkedin.com/posts/kleiton-kurti_github-kleiton0x00redditc2-abusing-reddit-activity-7009939662462984192-5DbI/?originalSubdomain=al author: Sorina Ionescu, X__Junior (Nextron Systems) date: 2022-08-17 modified: 2026-03-29 tags: - attack.command-and-control - attack.t1102 - attack.t1102.001 logsource: category: network_connection product: windows detection: selection: Initiated: 'true' DestinationHostname|endswith: - .t.me - 0x0.st - 4shared.com - abuse.ch - anonfiles.com - bashupload.com - cdn.discordapp.com - chunk.io - cloudflare.com - ddns.net - discord.com - docs.google.com - drive.google.com - dropbox.com - dropmefiles.com - facebook.com - feeds.rapidfeeds.com - fotolog.com - ghostbin.co/ - githubusercontent.com - gofile.io - hastebin.com - imgur.com - livejournal.com - mediafire.com - mega.co.nz - mega.nz - onedrive.com - pages.dev - paste.ee - pastebin.com - pastebin.pl - pastetext.net - pixeldrain.com - privatlab.com - privatlab.net - reddi