Query: detect Detects Commandlet names from well-known PowerShell exploitation frameworks in logs
Matching passage: Sigma rule: Detects Commandlet names from well-known PowerShell exploitation frameworks. Logsource: windows / process_creation. Rule: title: Malicious PowerShell Commandlets - ProcessCreation id: 02030f2f-6199-49ec-b258-ea71b07e03dc related: - id: 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6 type: derived - id: 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c type: similar status: test description: Detects Commandlet names from well-known PowerShell exploitation frameworks references: - https://adsecurity.org/?p=2921 - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ - https://github.com/calebstewart/CVE-2021-1675 - https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1 - https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html - https://github.com/HarmJ0y/DAMP - https://github.com/samratashok/nishang - https://github.com/DarkCoderSc/PowerRunAsSystem/ - https://github.com/besimorhino/powercat - https://github.com/Kevin-Robertson/Powermad - https://github.com/adrecon/ADRecon - https://github.com/adrecon/AzureADRecon - https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1 - https://github.com/The-Viper-One/Invoke-PowerDPAPI/ - https://github.com/Arno0x/DNSExfiltrator/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-01-02 modified: 2025-12-10 tags: - attack.execution - attack.discovery - attack.t1482 - attack.t1087 - attack.t1087.001 - attack.t1087.002 - attack.t1069.001 - attack.t1069.002 - attack.t1069 - attack.t1059.001 logsource: category: process_creation product: windows detection: selection: CommandLine|contains: - Add-Exfiltration - Add-Persistence - Add-RegBackdoor - Add-RemoteRegBackdoor - Add-ScrnSaveBackdoor - Check-VM - ConvertTo-Rc4ByteStream - Decrypt-Hash - Disable-ADIDNSNode - Disable-MachineAccount - Do-Exfiltration - Enable-ADIDNSNode - Enable-MachineAccount - Enabled-DuplicateToken - Exploit-Jboss - Ex
Near-miss passage: Sigma rule: Detects a method to load DLL via LSASS process using an undocumented Registry key. Logsource: windows / registry_event. Rule: title: DLL Load via LSASS id: b3503044-60ce-4bf4-bbcb-e3db98788823 status: test description: Detects a method to load DLL via LSASS process using an undocumented Registry key references: - https://blog.xpnsec.com/exploring-mimikatz-part-1/ - https://twitter.com/SBousseaden/status/1183745981189427200 author: Florian Roth (Nextron Systems) date: 2019-10-16 modified: 2022-04-21 tags: - attack.privilege-escalation - attack.execution - attack.persistence - attack.t1547.008 logsource: category: registry_event product: windows detection: selection: TargetObject|contains: - \CurrentControlSet\Services\NTDS\DirectoryServiceExtPt - \CurrentControlSet\Services\NTDS\LsaDbExtPt filter_domain_controller: Image: C:\Windows\system32\lsass.exe Details: - '%%systemroot%%\system32\ntdsa.dll' - '%%systemroot%%\system32\lsadb.dll' condition: selection and not 1 of filter_* falsepositives: - Unknown level: high