Query: write Sigma for Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
Matching passage: Sigma rule: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe. Logsource: windows / ps_module. Rule: title: Alternate PowerShell Hosts - PowerShell Module id: 64e8e417-c19a-475a-8d19-98ea705394cc status: test description: Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe references: - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html author: Roberto Rodriguez @Cyb3rWard0g date: 2019-08-11 modified: 2025-10-17 tags: - attack.execution - attack.t1059.001 logsource: product: windows category: ps_module definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b detection: selection: ContextInfo|contains: '*' filter_powershell: ContextInfo|contains: - = powershell - = C:\Windows\System32\WindowsPowerShell\v1.0\powershell - = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell - = C:/Windows/System32/WindowsPowerShell/v1.0/powershell - = C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell - = \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell - = \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell filter_sdiagnhost: ContextInfo|contains: = C:\WINDOWS\System32\sdiagnhost.exe -Embedding filter_citrix: ContextInfo|contains: ConfigSyncRun.exe filter_adace: ContextInfo|contains: C:\Windows\system32\dsac.exe filter_winrm: ContextInfo|contains: C:\Windows\system32\wsmprovhost.exe -Embedding filter_help_update: Payload|contains: - Update-Help - Failed to update Help for the module condition: selection and not 1 of filter_* falsepositives: - Programs using PowerShell directly without invocation of a dedicated interpreter - MSP Detection Searcher - Citrix ConfigSync.ps1 level: medium
Near-miss passage: Sigma rule: Detects the addition of a new rule to the Windows firewall via netsh. Logsource: windows / process_creation. Rule: title: New Firewall Rule Added Via Netsh.EXE id: cd5cfd80-aa5f-44c0-9c20-108c4ae12e3c status: test description: Detects the addition of a new rule to the Windows firewall via netsh references: - https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf author: Markus Neis, Sander Wiebing date: 2019-01-29 modified: 2023-02-10 tags: - attack.defense-impairment - attack.t1686.003 - attack.s0246 logsource: category: process_creation product: windows detection: selection_img: - Image|endswith: \netsh.exe - OriginalFileName: netsh.exe selection_cli: CommandLine|contains|all: - ' firewall ' - ' add ' filter_optional_dropbox: CommandLine|contains: - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files (x86)\Dropbox\Client\Dropbox.exe" enable=yes profile=Any - advfirewall firewall add rule name=Dropbox dir=in action=allow "program=?:\Program Files\Dropbox\Client\Dropbox.exe" enable=yes profile=Any condition: all of selection_* and not 1 of filter_optional_* falsepositives: - Legitimate administration activity - Software installations level: medium