deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PowerView PowerShell Cmdlets - ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Bhabesh Raj
Date: 2021-05-18
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Export-PowerViewCSV",
      "Find-DomainLocalGroupMember",
      "Find-DomainObjectPropertyOutlier",
      "Find-DomainProcess",
      "Find-DomainShare",
      "Find-DomainUserEvent",
      "Find-DomainUserLocation",
      "Find-ForeignGroup",
      "Find-ForeignUser",
      "Find-GPOComputerAdmin",
      "Find-GPOLocation",
      "Find-InterestingDomain",
      "Find-InterestingFile",
      "Find-LocalAdminAccess",
      "Find-ManagedSecurityGroups",
      "Get-CachedRDPConnection",
      "Get-DFSshare",
      "Get-DomainDFSShare",
      "Get-DomainDNSRecord",
      "Get-DomainDNSZone",
      "Get-DomainFileServer",
      "Get-DomainGPOComputerLocalGroupMapping",
      "Get-DomainGPOLocalGroup",
      "Get-DomainGPOUserLocalGroupMapping",
      "Get-LastLoggedOn",
      "Get-LoggedOnLocal",
      "Get-NetFileServer",
      "Get-NetForest",
      "Get-NetGPOGroup",
      "Get-NetProcess",
      "Get-NetRDPSession",
      "Get-RegistryMountedDrive",
      "Get-RegLoggedOn",
      "Get-WMIRegCachedRDPConnection",
      "Get-WMIRegLastLoggedOn",
      "Get-WMIRegMountedDrive",
      "Get-WMIRegProxy",
      "Invoke-ACLScanner",
      "Invoke-CheckLocalAdminAccess",
      "Invoke-EnumerateLocalAdmin",
      "Invoke-EventHunter",
      "Invoke-FileFinder",
      "Invoke-Kerberoast",
      "Invoke-MapDomainTrust",
      "Invoke-ProcessHunter",
      "Invoke-RevertToSelf",
      "Invoke-ShareFinder",
      "Invoke-UserHunt

References:
  - https://powersploit.readthedocs.io/en/stable/Recon/README
  - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
  - https://thedfirreport.com/2020/10/08/ryuks-return
  - https://adsecurity.org/?p=2277
Sigma Detection Rule: SyncAppvPublishingServer Execution to Bypass Powershell Restriction
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ensar Şamil, @sblmsrsn, OSCD Community
Date: 2020-10-05
ATT&CK techniques: T1218
Log source: windows/ps_script

Description:
Detects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "SyncAppvPublishingServer.exe"
  },
  "condition": "selection"
}

References:
  - https://lolbas-project.github.io/lolbas/Binaries/Syncappvpublishingserver/
Sigma Detection Rule: Invoke-Obfuscation Via Use Clip - Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-09
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated Powershell via use Clip.exe in Scripts

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|re": "(?i)echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?)"
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Suspicious Get Information for SMB Share
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-15
ATT&CK techniques: T1069.001
Log source: windows/ps_script

Description:
Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as
a precursor for Collection and to identify potential systems of interest for Lateral Movement.
Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "get-smbshare"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.002/T1069.002.md
Sigma Detection Rule: Suspicious Start-Process PassThru
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-15
ATT&CK techniques: T1036.003
Log source: windows/ps_script

Description:
Powershell use PassThru option to start in background

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Start-Process",
      "-PassThru ",
      "-FilePath "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1036.003/T1036.003.md
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
Sigma Detection Rule: PSAsyncShell - Asynchronous TCP Reverse Shell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-04
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "PSAsyncShell"
  },
  "condition": "selection"
}

References:
  - https://github.com/JoelGMSec/PSAsyncShell
Sigma Detection Rule: Malicious PowerShell Commandlets - ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer
Date: 2017-03-05
ATT&CK techniques: T1482, T1087, T1087.001, T1087.002, T1069.001, T1069.002, T1069, T1059.001
Log source: windows/ps_script

Description:
Detects Commandlet names from well-known PowerShell exploitation frameworks

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Add-Exfiltration",
      "Add-Persistence",
      "Add-RegBackdoor",
      "Add-RemoteRegBackdoor",
      "Add-ScrnSaveBackdoor",
      "ConvertTo-Rc4ByteStream",
      "Decrypt-Hash",
      "Disable-ADIDNSNode",
      "Do-Exfiltration",
      "Enable-ADIDNSNode",
      "Enabled-DuplicateToken",
      "Exploit-Jboss",
      "Export-ADRCSV",
      "Export-ADRExcel",
      "Export-ADRHTML",
      "Export-ADRJSON",
      "Export-ADRXML",
      "Find-Fruit",
      "Find-GPOLocation",
      "Find-TrustedDocuments",
      "Get-ADIDNSNodeAttribute",
      "Get-ADIDNSNodeOwner",
      "Get-ADIDNSNodeTombstoned",
      "Get-ADIDNSPermission",
      "Get-ADIDNSZone",
      "Get-ChromeDump",
      "Get-ClipboardContents",
      "Get-FoxDump",
      "Get-GPPPassword",
      "Get-IndexedItem",
      "Get-KerberosAESKey",
      "Get-Keystrokes",
      "Get-LSASecret",
      "Get-PassHashes",
      "Get-RegAlwaysInstallElevated",
      "Get-RegAutoLogon",
      "Get-RemoteBootKey",
      "Get-RemoteCachedCredential",
      "Get-RemoteLocalAccountHash",
      "Get-RemoteLSAKey",
      "Get-RemoteMachineAccountHash",
      "Get-RemoteNLKMKey",
      "Get-RickAstley",
      "Get-SecurityPackages",
      "Get-ServiceFilePermission",
      "Get-ServicePermission",
      "Get-ServiceUnquoted",
      "Get-SiteListPassword",
      "Get-System",
      "Get-TimedScreenshot",
      "Get-UnattendedInstallFile",
      "Get-Unconstrained",
     

References:
  - https://adsecurity.org/?p=2921
  - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries
  - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1
  - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1
  - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1
Sigma Detection Rule: Code Executed Via Office Add-in XLL File
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1137.006
Log source: windows/ps_script

Description:
Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.
Office add-ins can be used to add functionality to Office programs


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "new-object ",
      "-ComObject ",
      ".application",
      ".RegisterXLL"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1137.006/T1137.006.md
Sigma Detection Rule: Windows Screen Capture with CopyFromScreen
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1113
Log source: windows/ps_script

Description:
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.
Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": ".CopyFromScreen"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1113/T1113.md#atomic-test-6---windows-screen-capture-copyfromscreen
Sigma Detection Rule: Powershell Store File In Alternate Data Stream
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-09-02
ATT&CK techniques: T1564.004
Log source: windows/ps_script

Description:
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.

Detection logic:
{
  "selection_compspec": {
    "ScriptBlockText|contains|all": [
      "Start-Process",
      "-FilePath \"$env:comspec\" ",
      "-ArgumentList ",
      ">"
    ]
  },
  "condition": "selection_compspec"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
Sigma Detection Rule: Potential In-Memory Execution Using Reflection.Assembly
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-25
ATT&CK techniques: T1620
Log source: windows/ps_script

Description:
Detects usage of "Reflection.Assembly" load functions to dynamically load assemblies in memory

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "[Reflection.Assembly]::load"
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
Sigma Detection Rule: Invoke-Obfuscation CLIP+ Launcher - PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated use of Clip.exe to execute PowerShell

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|re": "cmd.{0,5}(?:/c|/r).+clip(?:\\.exe)?.{0,4}&&.+clipboard]::\\(\\s\\\\\"\\{\\d\\}.+-f.+\""
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Testing Usage of Uncommonly Used Port
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-23
ATT&CK techniques: T1571
Log source: windows/ps_script

Description:
Adversaries may communicate using a protocol and port paring that are typically not associated.
For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Test-NetConnection",
      "-ComputerName ",
      "-port "
    ]
  },
  "filter": {
    "ScriptBlockText|contains": [
      " 443 ",
      " 80 "
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1571/T1571.md#atomic-test-1---testing-usage-of-uncommonly-used-port-with-powershell
  - https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
Sigma Detection Rule: Enable Windows Remote Management
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-07
ATT&CK techniques: T1021.006
Log source: windows/ps_script

Description:
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": "Enable-PSRemoting "
  },
  "condition": "selection_cmdlet"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-1---enable-windows-remote-management
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.2
Sigma Detection Rule: Suspicious Invoke-Item From Mount-DiskImage
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-01
ATT&CK techniques: T1553.005
Log source: windows/ps_script

Description:
Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Mount-DiskImage ",
      "-ImagePath ",
      "Get-Volume",
      ".DriveLetter",
      "invoke-item ",
      "):\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-2---mount-an-iso-image-and-run-executable-from-the-iso
  - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
Sigma Detection Rule: PowerShell Deleted Mounted Share
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, @redcanary, Zach Stanford @svch0st
Date: 2020-10-08
ATT&CK techniques: T1070.005
Log source: windows/ps_script

Description:
Detects when when a mounted share is removed. Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Remove-SmbShare",
      "Remove-FileShare"
    ]
  },
  "filter_main_module_load": {
    "ScriptBlockText|contains|all": [
      "FileShare.cdxml",
      "Microsoft.PowerShell.Core\\Export-ModuleMember",
      "ROOT/Microsoft/Windows/Storage/MSFT_FileShare",
      "ObjectModelWrapper",
      "Cmdletization.MethodParameter"
    ]
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.005/T1070.005.md
Sigma Detection Rule: Clear PowerShell History - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Ilyas Ochkov, Jonhnathan Ribeiro, Daniil Yugoslavskiy, oscd.community
Date: 2022-01-25
ATT&CK techniques: T1070.003
Log source: windows/ps_script

Description:
Detects keywords that could indicate clearing PowerShell history

Detection logic:
{
  "selection1a": {
    "ScriptBlockText|contains": [
      "del",
      "Remove-Item",
      "rm"
    ]
  },
  "selection1b": {
    "ScriptBlockText|contains": "(Get-PSReadlineOption).HistorySavePath"
  },
  "selection_2": {
    "ScriptBlockText|contains|all": [
      "Set-PSReadlineOption",
      "\u2013HistorySaveStyle",
      "SaveNothing"
    ]
  },
  "selection_3": {
    "ScriptBlockText|contains|all": [
      "Set-PSReadlineOption",
      "-HistorySaveStyle",
      "SaveNothing"
    ]
  },
  "condition": "1 of selection_* or all of selection1*"
}

References:
  - https://gist.github.com/hook-s3c/7363a856c3cdbadeb71085147f042c1a
Sigma Detection Rule: Suspicious PowerShell Invocations - Generic
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-12
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects suspicious PowerShell invocation command parameters

Detection logic:
{
  "selection_encoded": {
    "ScriptBlockText|contains": [
      " -enc ",
      " -EncodedCommand ",
      " -ec "
    ]
  },
  "selection_hidden": {
    "ScriptBlockText|contains": [
      " -w hidden ",
      " -window hidden ",
      " -windowstyle hidden ",
      " -w 1 "
    ]
  },
  "selection_noninteractive": {
    "ScriptBlockText|contains": [
      " -noni ",
      " -noninteractive "
    ]
  },
  "condition": "all of selection*"
}

References:
  - Internal Research
Sigma Detection Rule: Disable-WindowsOptionalFeature Command PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-09-10
ATT&CK techniques: T1685
Log source: windows/ps_script

Description:
Detect built in PowerShell cmdlet Disable-WindowsOptionalFeature, Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images


Detection logic:
{
  "selection_cmd": {
    "ScriptBlockText|contains|all": [
      "Disable-WindowsOptionalFeature",
      "-Online",
      "-FeatureName"
    ]
  },
  "selection_feature": {
    "ScriptBlockText|contains": [
      "Windows-Defender-Gui",
      "Windows-Defender-Features",
      "Windows-Defender",
      "Windows-Defender-ApplicationGuard"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/5b67c9b141fa3918017f8fa44f2f88f0b1ecb9e1/atomics/T1562.001/T1562.001.md
  - https://learn.microsoft.com/en-us/powershell/module/dism/disable-windowsoptionalfeature?view=windowsserver2022-ps
Sigma Detection Rule: DirectorySearcher Powershell Exploitation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-12
ATT&CK techniques: T1018
Log source: windows/ps_script

Description:
Enumerates Active Directory to determine computers that are joined to the domain

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-Object ",
      "System.DirectoryServices.DirectorySearcher",
      ".PropertiesToLoad.Add",
      ".findall()",
      "Properties.name"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-15---enumerate-domain-computers-within-active-directory-using-directorysearcher
Sigma Detection Rule: Powershell XML Execute Command
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-19
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)
Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code


Detection logic:
{
  "selection_xml": {
    "ScriptBlockText|contains|all": [
      "New-Object",
      "System.Xml.XmlDocument",
      ".Load"
    ]
  },
  "selection_exec": {
    "ScriptBlockText|contains": [
      "IEX ",
      "Invoke-Expression ",
      "Invoke-Command ",
      "ICM -"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-8---powershell-xml-requests
Sigma Detection Rule: Windows Defender Exclusions Added - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Tim Rauch, Elastic (idea)
Date: 2022-09-16
ATT&CK techniques: T1685, T1059
Log source: windows/ps_script

Description:
Detects modifications to the Windows Defender configuration settings using PowerShell to add exclusions

Detection logic:
{
  "selection_args_exc": {
    "ScriptBlockText|contains": [
      " -ExclusionPath ",
      " -ExclusionExtension ",
      " -ExclusionProcess ",
      " -ExclusionIpAddress "
    ]
  },
  "selection_args_pref": {
    "ScriptBlockText|contains": [
      "Add-MpPreference ",
      "Set-MpPreference "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://www.elastic.co/guide/en/security/current/windows-defender-exclusions-added-via-powershell.html
Sigma Detection Rule: Powershell Suspicious Win32_PnPEntity
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-08-23
ATT&CK techniques: T1120
Log source: windows/ps_script

Description:
Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Win32_PnPEntity"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1120/T1120.md
Sigma Detection Rule: Powershell Sensitive File Discovery
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-09-16
ATT&CK techniques: T1083
Log source: windows/ps_script

Description:
Detect adversaries enumerate sensitive files

Detection logic:
{
  "selection_action": {
    "ScriptBlockText|contains": [
      "ls",
      "get-childitem",
      "gci"
    ]
  },
  "selection_recurse": {
    "ScriptBlockText|contains": "-recurse"
  },
  "selection_file": {
    "ScriptBlockText|contains": [
      ".pass",
      ".kdbx",
      ".kdb"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/malmoeb/status/[PII_REDACTED]70801158
Sigma Detection Rule: Potential PowerShell Obfuscation Using Alias Cmdlets
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2023-01-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Set-Alias ",
      "New-Alias "
    ]
  },
  "filter_main_cim": {
    "ScriptBlockText": [
      "Set-Alias -Name ncms -Value New-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name gcls -Value Get-CimClass -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name ncso -Value New-CimSessionOption -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name gcms -Value Get-CimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name rcms -Value Remove-cimSession -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name rcie -Value Register-CimIndicationEvent -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name gcai -Value Get-CimAssociatedInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name gcim -Value Get-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name scim -Value Set-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name ncim -Value New-CimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name rcim -Value Remove-cimInstance -Option ReadOnly, AllScope -ErrorAction SilentlyContinue",
      "Set-Alias -Name icim -Value Invoke-CimMethod -Option ReadOnly, AllScope -ErrorAction SilentlyContinue"
  

References:
  - https://github.com/1337Rin/Swag-PSO