deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Malicious PowerShell Commandlets - PoshModule
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-20
ATT&CK techniques: T1482, T1087, T1087.001, T1087.002, T1069.001, T1069.002, T1069, T1059.001
Log source: windows/ps_module

Description:
Detects Commandlet names from well-known PowerShell exploitation frameworks

Detection logic:
{
  "selection": {
    "Payload|contains": [
      "Add-Exfiltration",
      "Add-Persistence",
      "Add-RegBackdoor",
      "Add-RemoteRegBackdoor",
      "Add-ScrnSaveBackdoor",
      "BadSuccessor",
      "Check-VM",
      "ConvertTo-Rc4ByteStream",
      "Decrypt-Hash",
      "Disable-ADIDNSNode",
      "Disable-MachineAccount",
      "Do-Exfiltration",
      "Enable-ADIDNSNode",
      "Enable-MachineAccount",
      "Enabled-DuplicateToken",
      "Exploit-Jboss",
      "Export-ADR",
      "Export-ADRCSV",
      "Export-ADRExcel",
      "Export-ADRHTML",
      "Export-ADRJSON",
      "Export-ADRXML",
      "Find-Fruit",
      "Find-GPOLocation",
      "Find-TrustedDocuments",
      "Get-ADIDNS",
      "Get-ApplicationHost",
      "Get-ChromeDump",
      "Get-ClipboardContents",
      "Get-FoxDump",
      "Get-GPPPassword",
      "Get-IndexedItem",
      "Get-KerberosAESKey",
      "Get-Keystrokes",
      "Get-LSASecret",
      "Get-MachineAccountAttribute",
      "Get-MachineAccountCreator",
      "Get-PassHashes",
      "Get-RegAlwaysInstallElevated",
      "Get-RegAutoLogon",
      "Get-RemoteBootKey",
      "Get-RemoteCachedCredential",
      "Get-RemoteLocalAccountHash",
      "Get-RemoteLSAKey",
      "Get-RemoteMachineAccountHash",
      "Get-RemoteNLKMKey",
      "Get-RickAstley",
      "Get-Screenshot",
      "Get-SecurityPackages",
      "Get-ServiceFilePermission",
      "Get-ServicePermission",
      "Get-ServiceUnquoted",
      "Get-SiteListPassword",
      

References:
  - https://adsecurity.org/?p=2921
  - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries
  - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1
  - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1
  - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1
Sigma Detection Rule: Suspicious PowerShell Invocations - Generic - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-12
ATT&CK techniques: T1059.001
Log source: windows/ps_module

Description:
Detects suspicious PowerShell invocation command parameters

Detection logic:
{
  "selection_encoded": {
    "ContextInfo|contains": [
      " -enc ",
      " -EncodedCommand ",
      " -ec "
    ]
  },
  "selection_hidden": {
    "ContextInfo|contains": [
      " -w hidden ",
      " -window hidden ",
      " -windowstyle hidden ",
      " -w 1 "
    ]
  },
  "selection_noninteractive": {
    "ContextInfo|contains": [
      " -noni ",
      " -noninteractive "
    ]
  },
  "condition": "all of selection*"
}

References:
  - Internal Research
Sigma Detection Rule: PowerShell Decompress Commands
Repository: SigmaHQ/sigma
Severity: informational
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1140
Log source: windows/ps_module

Description:
A General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.

Detection logic:
{
  "selection_4103": {
    "Payload|contains": "Expand-Archive"
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/8
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/4.A.3_09F29912-8E93-461E-9E89-3F06F6763383.md
Sigma Detection Rule: Malicious PowerShell Scripts - PoshModule
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-23
ATT&CK techniques: T1059.001
Log source: windows/ps_module

Description:
Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance

Detection logic:
{
  "selection_generic": {
    "ContextInfo|contains": [
      "Add-ConstrainedDelegationBackdoor.ps1",
      "Add-Exfiltration.ps1",
      "Add-Persistence.ps1",
      "Add-RegBackdoor.ps1",
      "Add-RemoteRegBackdoor.ps1",
      "Add-ScrnSaveBackdoor.ps1",
      "BadSuccessor.ps1",
      "Check-VM.ps1",
      "ConvertTo-ROT13.ps1",
      "Copy-VSS.ps1",
      "Create-MultipleSessions.ps1",
      "DNS_TXT_Pwnage.ps1",
      "dnscat2.ps1",
      "Do-Exfiltration.ps1",
      "DomainPasswordSpray.ps1",
      "Download_Execute.ps1",
      "Download-Execute-PS.ps1",
      "Enabled-DuplicateToken.ps1",
      "Enable-DuplicateToken.ps1",
      "Execute-Command-MSSQL.ps1",
      "Execute-DNSTXT-Code.ps1",
      "Execute-OnTime.ps1",
      "ExetoText.ps1",
      "Exploit-Jboss.ps1",
      "Find-AVSignature.ps1",
      "Find-Fruit.ps1",
      "Find-GPOLocation.ps1",
      "Find-TrustedDocuments.ps1",
      "FireBuster.ps1",
      "FireListener.ps1",
      "Get-ApplicationHost.ps1",
      "Get-ChromeDump.ps1",
      "Get-ClipboardContents.ps1",
      "Get-ComputerDetail.ps1",
      "Get-FoxDump.ps1",
      "Get-GPPAutologon.ps1",
      "Get-GPPPassword.ps1",
      "Get-IndexedItem.ps1",
      "Get-Keystrokes.ps1",
      "Get-LSASecret.ps1",
      "Get-MicrophoneAudio.ps1",
      "Get-PassHashes.ps1",
      "Get-PassHints.ps1",
      "Get-RegAlwaysInstallElevated.ps1",
      "Get-RegAutoLogon.ps1",
      "Get-RickAstley.ps1",
      "Get-Screenshot.ps1",
      "Get-SecurityPackages.ps1

References:
  - https://github.com/PowerShellMafia/PowerSploit
  - https://github.com/NetSPI/PowerUpSQL
  - https://github.com/CsEnox/EventViewer-UACBypass
  - https://web.archive.org/web/[PII_REDACTED]4621/https://github.com/AlsidOfficial/WSUSpendu
  - https://github.com/nettitude/Invoke-PowerThIEf
Sigma Detection Rule: Alternate PowerShell Hosts - PowerShell Module
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-11
ATT&CK techniques: T1059.001
Log source: windows/ps_module

Description:
Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Detection logic:
{
  "selection": {
    "ContextInfo|contains": "*"
  },
  "filter_powershell": {
    "ContextInfo|contains": [
      "= powershell",
      "= C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "= C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell",
      "= C:/Windows/System32/WindowsPowerShell/v1.0/powershell",
      "= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell",
      "= \\\\\\?\\?\\C:Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "= \\\\\\?\\?\\C:Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell"
    ]
  },
  "filter_sdiagnhost": {
    "ContextInfo|contains": "= C:\\WINDOWS\\System32\\sdiagnhost.exe -Embedding"
  },
  "filter_citrix": {
    "ContextInfo|contains": "ConfigSyncRun.exe"
  },
  "filter_adace": {
    "ContextInfo|contains": "C:\\Windows\\system32\\dsac.exe"
  },
  "filter_winrm": {
    "ContextInfo|contains": "C:\\Windows\\system32\\wsmprovhost.exe -Embedding"
  },
  "filter_help_update": {
    "Payload|contains": [
      "Update-Help",
      "Failed to update Help for the module"
    ]
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html
Sigma Detection Rule: Remote PowerShell Session (PS Module)
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g, Tim Shelton
Date: 2019-08-10
ATT&CK techniques: T1059.001, T1021.006
Log source: windows/ps_module

Description:
Detects remote PowerShell sessions

Detection logic:
{
  "selection": {
    "ContextInfo|contains|all": [
      " = ServerRemoteHost ",
      "wsmprovhost.exe"
    ]
  },
  "filter_pwsh_archive": {
    "ContextInfo|contains": "\\Windows\\system32\\WindowsPowerShell\\v1.0\\Modules\\Microsoft.PowerShell.Archive\\Microsoft.PowerShell.Archive.psm1"
  },
  "condition": "selection and not 1 of filter_*"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
Sigma Detection Rule: Potential Active Directory Enumeration Using AD Module - PsModule
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2023-01-22
Log source: windows/ps_module

Description:
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.

Detection logic:
{
  "selection_cmdlet": {
    "Payload|contains": [
      "Import-Module ",
      "ipmo "
    ]
  },
  "selection_dll": {
    "Payload|contains": "Microsoft.ActiveDirectory.Management.dll"
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/samratashok/ADModule
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]66061568?s=20
  - https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/active-directory-enumeration-with-ad-module-without-rsat-or-admin-privileges
Sigma Detection Rule: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated Powershell via VAR++ LAUNCHER

Detection logic:
{
  "selection_4103": {
    "Payload|re": "(?i)&&set.*(\\{\\d\\}){2,}\\\\\"\\s+?-f.*&&.*cmd.*/c"
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: PowerShell Get Clipboard
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-05-02
ATT&CK techniques: T1115
Log source: windows/ps_module

Description:
A General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.

Detection logic:
{
  "selection": {
    "Payload|contains": "Get-Clipboard"
  },
  "condition": "selection"
}

References:
  - https://github.com/OTRF/detection-hackathon-apt29/issues/16
  - https://github.com/OTRF/ThreatHunter-Playbook/blob/2d4257f630f4c9770f78d0c1df059f891ffc3fec/docs/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.md
Sigma Detection Rule: Invoke-Obfuscation Via Stdin - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated Powershell via Stdin in Scripts

Detection logic:
{
  "selection_4103": {
    "Payload|re": "(?i)(set).*&&\\s?set.*(environment|invoke|\\$?\\{?input).*&&.*\""
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Use Get-NetTCPConnection - PowerShell Module
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-10
ATT&CK techniques: T1049
Log source: windows/ps_module

Description:
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Detection logic:
{
  "selection": {
    "ContextInfo|contains": "Get-NetTCPConnection"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-2---system-network-connections-discovery-with-powershell
Sigma Detection Rule: Suspicious Get-ADDBAccount Usage
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-03-16
ATT&CK techniques: T1003.003
Log source: windows/ps_module

Description:
Detects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers

Detection logic:
{
  "selection": {
    "Payload|contains|all": [
      "Get-ADDBAccount",
      "BootKey ",
      "DatabasePath "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.n00py.io/2022/03/manipulating-user-passwords-without-mimikatz/
  - https://github.com/MichaelGrafnetter/DSInternals/blob/7ba59c12ee9a1cb430d7dc186a3366842dd612c8/Documentation/PowerShell/Get-ADDBAccount.md
Sigma Detection Rule: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Detection logic:
{
  "selection_4103": {
    "Payload|contains|all": [
      "new-object",
      "text.encoding]::ascii"
    ],
    "Payload|contains": [
      "system.io.compression.deflatestream",
      "system.io.streamreader"
    ],
    "Payload|endswith": "readtoend"
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Suspicious PowerShell Invocations - Specific - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Date: 2017-03-05
ATT&CK techniques: T1059.001
Log source: windows/ps_module

Description:
Detects suspicious PowerShell invocation command parameters

Detection logic:
{
  "selection_convert_b64": {
    "ContextInfo|contains|all": [
      "-nop",
      " -w ",
      "hidden",
      " -c ",
      "[Convert]::FromBase64String"
    ]
  },
  "selection_iex": {
    "ContextInfo|contains|all": [
      " -w ",
      "hidden",
      "-noni",
      "-nop",
      " -c ",
      "iex",
      "New-Object"
    ]
  },
  "selection_enc": {
    "ContextInfo|contains|all": [
      " -w ",
      "hidden",
      "-ep",
      "bypass",
      "-Enc"
    ]
  },
  "selection_reg": {
    "ContextInfo|contains|all": [
      "powershell",
      "reg",
      "add"
    ],
    "ContextInfo|contains": [
      "\\software\\microsoft\\windows\\currentversion\\run",
      "\\software\\wow6432node\\microsoft\\windows\\currentversion\\run",
      "\\software\\microsoft\\windows\\currentversion\\policies\\explorer\\run"
    ]
  },
  "selection_webclient": {
    "ContextInfo|contains|all": [
      "bypass",
      "-noprofile",
      "-windowstyle",
      "hidden",
      "new-object",
      "system.net.webclient",
      ".download"
    ]
  },
  "selection_iex_webclient": {
    "ContextInfo|contains|all": [
      "iex",
      "New-Object",
      "Net.WebClient",
      ".Download"
    ]
  },
  "filter_chocolatey": {
    "ContextInfo|contains": [
      "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1",
      "Write-ChocolateyWarning"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_*"
}

References:
  - Internal Research
  - https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Sigma Detection Rule: Invoke-Obfuscation VAR+ Launcher - PowerShell Module
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Jonathan Cheong, oscd.community
Date: 2020-10-15
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_module

Description:
Detects Obfuscated use of Environment Variables to execute PowerShell

Detection logic:
{
  "selection_4103": {
    "Payload|re": "cmd.{0,5}(?:/c|/r)(?:\\s|)\"set\\s[a-zA-Z]{3,6}.*(?:\\{\\d\\}){1,}\\\\\"\\s+?-f(?:.*\\)){1,}.*\""
  },
  "condition": "selection_4103"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Renamed Powershell Under Powershell Channel
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Harish Segar, frack113
Date: 2020-06-29
ATT&CK techniques: T1059.001, T1036.003
Log source: windows/ps_classic_start

Description:
Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.


Detection logic:
{
  "selection": {
    "Data|contains": "HostName=ConsoleHost"
  },
  "filter_main_ps": {
    "Data|contains": [
      "HostApplication=powershell",
      "HostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell",
      "HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell",
      "HostApplication=C:\\\\\\\\WINDOWS\\\\\\\\system32\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe",
      "HostApplication=C:\\\\\\\\WINDOWS\\\\\\\\SysWOW64\\\\\\\\WindowsPowerShell\\\\\\\\v1.0\\\\\\\\powershell.exe"
    ]
  },
  "filter_main_host_application_null": {
    "Data|re": "HostId=[a-zA-Z0-9-]{36}\\s+EngineVersion="
  },
  "condition": "selection and not 1 of filter_main_*"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse
Sigma Detection Rule: Tamper Windows Defender - PSClassic
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-06-07
ATT&CK techniques: T1685
Log source: windows/ps_classic_provider_start

Description:
Attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Detection logic:
{
  "selection_set_mppreference": {
    "Data|contains": "Set-MpPreference"
  },
  "selection_options_bool_allow": {
    "Data|contains": [
      "-dbaf $true",
      "-dbaf 1",
      "-dbm $true",
      "-dbm 1",
      "-dips $true",
      "-dips 1",
      "-DisableArchiveScanning $true",
      "-DisableArchiveScanning 1",
      "-DisableBehaviorMonitoring $true",
      "-DisableBehaviorMonitoring 1",
      "-DisableBlockAtFirstSeen $true",
      "-DisableBlockAtFirstSeen 1",
      "-DisableCatchupFullScan $true",
      "-DisableCatchupFullScan 1",
      "-DisableCatchupQuickScan $true",
      "-DisableCatchupQuickScan 1",
      "-DisableIntrusionPreventionSystem $true",
      "-DisableIntrusionPreventionSystem 1",
      "-DisableIOAVProtection $true",
      "-DisableIOAVProtection 1",
      "-DisableRealtimeMonitoring $true",
      "-DisableRealtimeMonitoring 1",
      "-DisableRemovableDriveScanning $true",
      "-DisableRemovableDriveScanning 1",
      "-DisableScanningMappedNetworkDrivesForFullScan $true",
      "-DisableScanningMappedNetworkDrivesForFullScan 1",
      "-DisableScanningNetworkFiles $true",
      "-DisableScanningNetworkFiles 1",
      "-DisableScriptScanning $true",
      "-DisableScriptScanning 1",
      "-MAPSReporting $false",
      "-MAPSReporting 0",
      "-drdsc $true",
      "-drdsc 1",
      "-drtm $true",
      "-drtm 1",
      "-dscrptsc $true",
      "-dscrptsc 1",
      "-dsmndf $true",
      "-dsmndf 1",
      "-dsnf $true",
      "-dsnf 1

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
Sigma Detection Rule: Suspicious Non PowerShell WSMAN COM Provider
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
Date: 2020-06-24
ATT&CK techniques: T1059.001, T1021.003
Log source: windows/

Description:
Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Detection logic:
{
  "selection": {
    "Data|contains": "ProviderName=WSMan"
  },
  "filter_main_ps": {
    "Data|contains": [
      "HostApplication=powershell",
      "HostApplication=C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell",
      "HostApplication=C:/Windows/System32/WindowsPowerShell/v1.0/powershell",
      "HostApplication=C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell"
    ]
  },
  "filter_main_host_application_null": {
    "Data|re": "HostId=[a-zA-Z0-9-]{36}\\s+EngineVersion="
  },
  "filter_optional_hexnode": {
    "Data|contains": "HostApplication=C:\\Hexnode\\Hexnode Agent\\Current\\HexnodeAgent.exe"
  },
  "condition": "selection and not 1 of filter_main_* and not 1 of filter_optional_*"
}

References:
  - https://twitter.com/chadtilbury/status/[PII_REDACTED]70610688
  - https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/
  - https://github.com/bohops/WSMan-WinRM
Sigma Detection Rule: PowerShell Download Via Net.WebClient - PowerShell Classic
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-05
ATT&CK techniques: T1059.001, T1105
Log source: windows/ps_classic_start

Description:
Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.
This technique is often abused by attackers to download additional payloads.


Detection logic:
{
  "selection_webclient": {
    "Data|contains": "Net.WebClient"
  },
  "selection_download": {
    "Data|contains": [
      ".DownloadFile(",
      ".DownloadString("
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html
Sigma Detection Rule: Netcat The Powershell Version
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-21
ATT&CK techniques: T1095, T1059.001
Log source: windows/ps_classic_start

Description:
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network

Detection logic:
{
  "selection": {
    "Data|contains": [
      "powercat ",
      "powercat.ps1"
    ]
  },
  "condition": "selection"
}

References:
  - https://nmap.org/ncat/
  - https://github.com/besimorhino/powercat
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
Sigma Detection Rule: Potential RemoteFXvGPUDisablement.EXE Abuse
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-07-13
ATT&CK techniques: T1218
Log source: windows/

Description:
Detects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of  the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.

Detection logic:
{
  "selection": {
    "Data|contains": "ModuleContents=function Get-VMRemoteFXPhysicalVideoAdapter {"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
Sigma Detection Rule: Remote PowerShell Session (PS Classic)
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: Roberto Rodriguez @Cyb3rWard0g
Date: 2019-08-10
ATT&CK techniques: T1059.001, T1021.006
Log source: windows/ps_classic_start

Description:
Detects remote PowerShell sessions

Detection logic:
{
  "selection": {
    "Data|contains|all": [
      "HostName=ServerRemoteHost",
      "wsmprovhost.exe"
    ]
  },
  "condition": "selection"
}

References:
  - https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html