Query: detection rule: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7
Matching passage: Sigma rule: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7. Logsource: windows / ps_script. Rule: title: PowerShell ADRecon Execution id: bf72941a-cba0-41ea-b18c-9aca3925690d status: test description: Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7 references: - https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1 - https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 author: Bhabesh Raj date: 2021-07-16 modified: 2022-09-06 tags: - attack.discovery - attack.execution - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - Function Get-ADRExcelComOb - Get-ADRGPO - Get-ADRDomainController - ADRecon-Report.xlsx condition: selection falsepositives: - Unknown level: high
Near-miss passage: Sigma rule: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts. Logsource: windows / ps_script. Rule: title: Potential PowerShell Obfuscation Using Alias Cmdlets id: 96cd126d-f970-49c4-848a-da3a09f55c55 related: - id: e8314f79-564d-4f79-bc13-fbc0bf2660d8 type: derived status: test description: Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts references: - https://github.com/1337Rin/Swag-PSO author: frack113 date: 2023-01-08 modified: 2025-10-22 tags: - attack.execution - attack.stealth - attack.t1027 - attack.t1059.001 logsource: product: windows category: ps_script definition: 'Requirements: Script Block Logging must be enabled' detection: selection: ScriptBlockText|contains: - 'Set-Alias ' - 'New-Alias ' filter_main_cim: ScriptBlockText: - Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue - Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue condition: selection and not 1 of filter_main_* falsepositives: - Unknown level: low