Query: write Sigma for Detects suspicious PowerShell invocation command parameters
Matching passage: Sigma rule: Detects suspicious PowerShell invocation command parameters. Logsource: windows / ps_script. Rule: title: Suspicious PowerShell Invocations - Specific id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71 related: - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c type: obsolete - id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090 type: similar - id: 536e2947-3729-478c-9903-745aaffe60d2 type: similar status: test description: Detects suspicious PowerShell invocation command parameters references: - Internal Research - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro date: 2017-03-05 modified: 2025-02-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection_convert_b64: ScriptBlockText|contains|all: - -nop - ' -w ' - hidden - ' -c ' - '[Convert]::FromBase64String' selection_iex_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -noni - -nop - ' -c ' - iex - New-Object selection_enc_selection: ScriptBlockText|contains|all: - ' -w ' - hidden - -ep - bypass - -Enc selection_reg_selection: ScriptBlockText|contains|all: - powershell - reg - add ScriptBlockText|contains: - \software\microsoft\windows\currentversion\run - \software\wow6432node\microsoft\windows\currentversion\run - \software\microsoft\windows\currentversion\policies\explorer\run selection_webclient_selection: ScriptBlockText|contains|all: - bypass - -noprofile - -windowstyle - hidden - new-object - system.net.webclient - .download selection_iex_webclient: ScriptBlockText|contains|all: - iex - New-Object - Net.WebClient - .Download filter_chocolatey: ScriptBlockText|contains: - (New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1 - (New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1') - Write-ChocolateyWarning condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects creation of a file with an ".rdp" extension by an application that doesn't commonly create such files.. Logsource: windows / file_event. Rule: title: .RDP File Created By Uncommon Application id: fccfb43e-09a7-4bd2-8b37-a5a7df33386d related: - id: f748c45a-f8d3-4e6f-b617-fe176f695b8f type: derived status: test description: 'Detects creation of a file with an ".rdp" extension by an application that doesn''t commonly create such files. ' references: - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/ - https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/ author: Nasreddine Bencherchali (Nextron Systems) date: 2023-04-18 modified: 2024-11-01 tags: - attack.stealth logsource: product: windows category: file_event detection: selection: TargetFilename|endswith: .rdp Image|endswith: - \brave.exe - \CCleaner Browser\Application\CCleanerBrowser.exe - \chromium.exe - \firefox.exe - \Google\Chrome\Application\chrome.exe - \iexplore.exe - \microsoftedge.exe - \msedge.exe - \Opera.exe - \Vivaldi.exe - \Whale.exe - \olk.exe - \Outlook.exe - \RuntimeBroker.exe - \Thunderbird.exe - \Discord.exe - \Keybase.exe - \msteams.exe - \Slack.exe - \teams.exe condition: selection falsepositives: - Unknown level: high