Query: detect Detects Commandlet names and arguments from the Nishang exploitation framework in logs
Matching passage: Sigma rule: Detects Commandlet names and arguments from the Nishang exploitation framework. Logsource: windows / ps_script. Rule: title: Malicious Nishang PowerShell Commandlets id: f772cee9-b7c2-4cb2-8f07-49870adc02e0 status: test description: Detects Commandlet names and arguments from the Nishang exploitation framework references: - https://github.com/samratashok/nishang author: Alec Costello date: 2019-05-16 modified: 2023-01-16 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Add-ConstrainedDelegationBackdoor - Copy-VSS - Create-MultipleSessions - DataToEncode - DNS_TXT_Pwnage - Do-Exfiltration-Dns - Download_Execute - Download-Execute-PS - DownloadAndExtractFromRemoteRegistry - DumpCerts - DumpCreds - DumpHashes - Enable-DuplicateToken - Enable-Duplication - Execute-Command-MSSQL - Execute-DNSTXT-Code - Execute-OnTime - ExetoText - exfill - ExfilOption - FakeDC - FireBuster - FireListener - 'Get-Information ' - Get-PassHints - Get-Web-Credentials - Get-WebCredentials - Get-WLAN-Keys - HTTP-Backdoor - Invoke-AmsiBypass - Invoke-BruteForce - Invoke-CredentialsPhish - Invoke-Decode - Invoke-Encode - Invoke-Interceptor - Invoke-JSRatRegsvr - Invoke-JSRatRundll - Invoke-MimikatzWDigestDowngrade - Invoke-NetworkRelay - Invoke-PowerShellIcmp - Invoke-PowerShellUdp - Invoke-Prasadhak - Invoke-PSGcat - Invoke-PsGcatAgent - Invoke-SessionGopher - Invoke-SSIDExfil - LoggedKeys - Nishang - NotAllNameSpaces - Out-CHM - OUT-DNSTXT - Out-HTA - Out-RundllCommand - Out-SCF - Out-SCT - Out-Shortcut - Out-WebQuery - Out-Word - Parse_Keys - Password-List - Powerpreter - Remove-Persistence - Remove-PoshRat - Remove-Update - Run-EXEonRemote - Set-DCShadowPermissions - Set-RemotePSRemoting - Set-RemoteWMI - Shellcode32 - Shellcode64 - StringtoBase64 - TexttoExe condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by. Logsource: windows / process_creation. Rule: title: Boot Configuration Tampering Via Bcdedit.EXE id: 1444443e-6757-43e4-9ea4-c8fc705f79a2 status: stable description: Detects the use of the bcdedit command to tamper with the boot configuration data. This technique is often times used by malware or attackers as a destructive way before launching ransomware. references: - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md - https://eqllib.readthedocs.io/en/latest/analytics/c4732632-9c1d-4980-9fa8-1d98c93f918e.html author: E.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community date: 2019-10-24 modified: 2023-02-15 tags: - attack.impact - attack.t1490 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \bcdedit.exe - OriginalFileName: bcdedit.exe selection_set: CommandLine|contains: set selection_cli: - CommandLine|contains|all: - bootstatuspolicy - ignoreallfailures - CommandLine|contains|all: - recoveryenabled - 'no' condition: all of selection_* falsepositives: - Unlikely level: high simulation: - type: atomic-red-team name: Windows - Disable Windows Recovery Console Repair technique: T1490 atomic_guid: cf21060a-80b3-4238-a595-22525de4ab81