deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Windows Firewall Profile Disabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Austin Songer @austinsonger
Date: 2021-10-12
ATT&CK techniques: T1686.003
Log source: windows/ps_script

Description:
Detects when a user disables the Windows Firewall via a Profile to help evade defense.

Detection logic:
{
  "selection_args": {
    "ScriptBlockText|contains|all": [
      "Set-NetFirewallProfile ",
      " -Enabled ",
      " False"
    ]
  },
  "selection_opt": {
    "ScriptBlockText|contains": [
      " -All ",
      "Public",
      "Domain",
      "Private"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/netsecurity/set-netfirewallprofile?view=windowsserver2022-ps
  - https://www.tutorialspoint.com/how-to-get-windows-firewall-profile-settings-using-powershell
  - https://web.archive.org/web/[PII_REDACTED]3836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
  - http://woshub.com/manage-windows-firewall-powershell/
  - https://www.elastic.co/guide/en/security/current/windows-firewall-disabled-via-powershell.html
Sigma Detection Rule: Invoke-Obfuscation Via Stdin - Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-12
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated Powershell via Stdin in Scripts

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|re": "(?i)(set).*&&\\s?set.*(environment|invoke|\\$\\{?input).*&&.*\""
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Suspicious GetTypeFromCLSID ShellExecute
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-02
ATT&CK techniques: T1546.015
Log source: windows/ps_script

Description:
Detects suspicious Powershell code that execute COM Objects

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "::GetTypeFromCLSID(",
      ".ShellExecute("
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.015/T1546.015.md#atomic-test-2---powershell-execute-com-object
Sigma Detection Rule: Suspicious Hyper-V Cmdlets
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-09
ATT&CK techniques: T1564.006
Log source: windows/ps_script

Description:
Adversaries may carry out malicious operations using a virtual instance to avoid detection

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "New-VM",
      "Set-VMFirmware",
      "Start-VM"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.006/T1564.006.md#atomic-test-3---create-and-start-hyper-v-virtual-machine
Sigma Detection Rule: Suspicious Kerberos Ticket Request via PowerShell Script - ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1558.003
Log source: windows/ps_script

Description:
Detects PowerShell scripts that utilize native PowerShell Identity modules to request Kerberos tickets.
This behavior is typically seen during a Kerberos or silver ticket attack. A successful execution will output the SPNs for the endpoint in question.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "System.IdentityModel.Tokens.KerberosRequestorSecurityToken",
      ".GetRequest()"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1558.003/T1558.003.md#atomic-test-4---request-a-single-ticket-via-powershell
  - https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1
Sigma Detection Rule: Powershell Keylogging
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-30
ATT&CK techniques: T1056.001
Log source: windows/ps_script

Description:
Adversaries may log user keystrokes to intercept credentials as the user types them.

Detection logic:
{
  "selection_basic": {
    "ScriptBlockText|contains": "Get-Keystrokes"
  },
  "selection_high": {
    "ScriptBlockText|contains|all": [
      "Get-ProcAddress user32.dll GetAsyncKeyState",
      "Get-ProcAddress user32.dll GetForegroundWindow"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218/T1218.md
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/src/Get-Keystrokes.ps1
Sigma Detection Rule: PowerShell Hotfix Enumeration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-21
Log source: windows/ps_script

Description:
Detects call to "Win32_QuickFixEngineering" in order to enumerate installed hotfixes often used in "enum" scripts by attackers

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Win32_QuickFixEngineering",
      "HotFixID"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/411Hall/JAWS/blob/233f142fcb1488172aa74228a666f6b3c5c48f1d/jaws-enum.ps1
Sigma Detection Rule: Powershell Add Name Resolution Policy Table Rule
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Borna Talebi
Date: 2021-09-14
ATT&CK techniques: T1565
Log source: windows/ps_script

Description:
Detects powershell scripts that adds a Name Resolution Policy Table (NRPT) rule for the specified namespace.
This will bypass the default DNS server and uses a specified server for answering the query.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Add-DnsClientNrptRule",
      "-Namesp",
      "-NameSe"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/NathanMcNulty/status/[PII_REDACTED]41287681
  - https://learn.microsoft.com/en-us/powershell/module/dnsclient/add-dnsclientnrptrule?view=windowsserver2022-ps
Sigma Detection Rule: DMSA Link Attributes Modified
Repository: SigmaHQ/sigma
Severity: low
Status: experimental
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2025-05-24
ATT&CK techniques: T1078.002, T1098
Log source: windows/ps_script

Description:
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      ".Put(\"msDS-ManagedAccountPrecededByLink",
      "CN="
    ]
  },
  "condition": "selection"
}

References:
  - https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory
Sigma Detection Rule: PowerShell Script With File Upload Capabilities
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-07
ATT&CK techniques: T1020
Log source: windows/ps_script

Description:
Detects PowerShell scripts leveraging the "Invoke-WebRequest" cmdlet to send data via either "PUT" or "POST" method.

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": [
      "Invoke-RestMethod",
      "Invoke-WebRequest",
      "irm ",
      "iwr "
    ]
  },
  "selection_flag": {
    "ScriptBlockText|contains": [
      "-Method \"POST\"",
      "-Method \"PUT\"",
      "-Method POST",
      "-Method PUT",
      "-Method 'POST'",
      "-Method 'PUT'"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md
  - https://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-webrequest?view=powershell-7.4
Sigma Detection Rule: Import PowerShell Modules From Suspicious Directories
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-07
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects powershell scripts that import modules from suspicious directories

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Import-Module \"$Env:Temp\\",
      "Import-Module '$Env:Temp\\",
      "Import-Module $Env:Temp\\",
      "Import-Module \"$Env:Appdata\\",
      "Import-Module '$Env:Appdata\\",
      "Import-Module $Env:Appdata\\",
      "Import-Module C:\\Users\\Public\\",
      "ipmo \"$Env:Temp\\",
      "ipmo '$Env:Temp\\",
      "ipmo $Env:Temp\\",
      "ipmo \"$Env:Appdata\\",
      "ipmo '$Env:Appdata\\",
      "ipmo $Env:Appdata\\",
      "ipmo C:\\Users\\Public\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md
Sigma Detection Rule: Powershell Local Email Collection
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-21
ATT&CK techniques: T1114.001
Log source: windows/ps_script

Description:
Adversaries may target user email on local systems to collect sensitive information.
Files containing email data can be acquired from a users local system, such as Outlook storage or cache files.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Get-Inbox.ps1",
      "Microsoft.Office.Interop.Outlook",
      "Microsoft.Office.Interop.Outlook.olDefaultFolders",
      "-comobject outlook.application"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1114.001/T1114.001.md
Sigma Detection Rule: Troubleshooting Pack Cmdlet Execution
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-21
ATT&CK techniques: T1202
Log source: windows/ps_script

Description:
Detects execution of "TroubleshootingPack" cmdlets to leverage CVE-2022-30190 or action similar to "msdt" lolbin (as described in LOLBAS)

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Invoke-TroubleshootingPack",
      "C:\\Windows\\Diagnostics\\System\\PCW",
      "-AnswerFile",
      "-Unattended"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/nas_bench/status/[PII_REDACTED]31772161
  - https://lolbas-project.github.io/lolbas/Binaries/Msdt/
Sigma Detection Rule: Malicious Nishang PowerShell Commandlets
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Alec Costello
Date: 2019-05-16
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects Commandlet names and arguments from the Nishang exploitation framework

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Add-ConstrainedDelegationBackdoor",
      "Copy-VSS",
      "Create-MultipleSessions",
      "DataToEncode",
      "DNS_TXT_Pwnage",
      "Do-Exfiltration-Dns",
      "Download_Execute",
      "Download-Execute-PS",
      "DownloadAndExtractFromRemoteRegistry",
      "DumpCerts",
      "DumpCreds",
      "DumpHashes",
      "Enable-DuplicateToken",
      "Enable-Duplication",
      "Execute-Command-MSSQL",
      "Execute-DNSTXT-Code",
      "Execute-OnTime",
      "ExetoText",
      "exfill",
      "ExfilOption",
      "FakeDC",
      "FireBuster",
      "FireListener",
      "Get-Information ",
      "Get-PassHints",
      "Get-Web-Credentials",
      "Get-WebCredentials",
      "Get-WLAN-Keys",
      "HTTP-Backdoor",
      "Invoke-AmsiBypass",
      "Invoke-BruteForce",
      "Invoke-CredentialsPhish",
      "Invoke-Decode",
      "Invoke-Encode",
      "Invoke-Interceptor",
      "Invoke-JSRatRegsvr",
      "Invoke-JSRatRundll",
      "Invoke-MimikatzWDigestDowngrade",
      "Invoke-NetworkRelay",
      "Invoke-PowerShellIcmp",
      "Invoke-PowerShellUdp",
      "Invoke-Prasadhak",
      "Invoke-PSGcat",
      "Invoke-PsGcatAgent",
      "Invoke-SessionGopher",
      "Invoke-SSIDExfil",
      "LoggedKeys",
      "Nishang",
      "NotAllNameSpaces",
      "Out-CHM",
      "OUT-DNSTXT",
      "Out-HTA",
      "Out-RundllCommand",
      "Out-SCF",
      "Out-SCT",
      "Out-Shortcut",
      "Out-WebQuery",
      "

References:
  - https://github.com/samratashok/nishang
Sigma Detection Rule: Access to Browser Login Data
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-30
ATT&CK techniques: T1555.003
Log source: windows/ps_script

Description:
Adversaries may acquire credentials from web browsers by reading files specific to the target browser.
Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.
Web browsers typically store the credentials in an encrypted format within a credential store.


Detection logic:
{
  "selection_cmd": {
    "ScriptBlockText|contains|all": [
      "Copy-Item",
      "-Destination"
    ]
  },
  "selection_path": {
    "ScriptBlockText|contains": [
      "\\Opera Software\\Opera Stable\\Login Data",
      "\\Mozilla\\Firefox\\Profiles",
      "\\Microsoft\\Edge\\User Data\\Default",
      "\\Google\\Chrome\\User Data\\Default\\Login Data",
      "\\Google\\Chrome\\User Data\\Default\\Login Data For Account"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
Sigma Detection Rule: PowerShell Script Change Permission Via Set-Acl - PsScript
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2023-07-18
ATT&CK techniques: T1222
Log source: windows/ps_script

Description:
Detects PowerShell scripts set ACL to of a file or a folder

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Set-Acl ",
      "-AclObject ",
      "-Path "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c[PII_REDACTED]7dc884cb1a39/atomics/T1505.005/T1505.005.md
Sigma Detection Rule: Remove Account From Domain Admin Group
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-26
ATT&CK techniques: T1531
Log source: windows/ps_script

Description:
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Remove-ADGroupMember",
      "-Identity ",
      "-Members "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1531/T1531.md#atomic-test-3---remove-account-from-domain-admin-group
Sigma Detection Rule: Create Volume Shadow Copy with Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-12
ATT&CK techniques: T1003.003
Log source: windows/ps_script

Description:
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Win32_ShadowCopy",
      ").Create(",
      "ClientAccessible"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1&viewFallbackFrom=powershell-7
Sigma Detection Rule: Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|contains|all": [
      "new-object",
      "text.encoding]::ascii"
    ],
    "ScriptBlockText|contains": [
      "system.io.compression.deflatestream",
      "system.io.streamreader"
    ],
    "ScriptBlockText|endswith": "readtoend"
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Malicious ShellIntel PowerShell Commandlets
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)
Date: 2021-08-09
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects Commandlet names from ShellIntel exploitation scripts.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Invoke-SMBAutoBrute",
      "Invoke-GPOLinks",
      "Invoke-Potato"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Shellntel/scripts/
Sigma Detection Rule: HackTool - WinPwn Execution - ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Swachchhanda Shrawan Poudel
Date: 2023-12-04
ATT&CK techniques: T1046, T1082, T1106, T1518, T1548.002, T1552.001, T1555, T1555.003
Log source: windows/ps_script

Description:
Detects scriptblock text keywords indicative of potential usge of the tool WinPwn. A tool for Windows and Active Directory reconnaissance and exploitation.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Offline_Winpwn",
      "WinPwn ",
      "WinPwn.exe",
      "WinPwn.ps1"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/S3cur3Th1sSh1t/WinPwn
  - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?[PII_REDACTED]
  - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
  - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
  - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
Sigma Detection Rule: Potential Data Exfiltration Via Audio File
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-16
Log source: windows/ps_script

Description:
Detects potential exfiltration attempt via audio file using PowerShell

Detection logic:
{
  "selection_main": {
    "ScriptBlockText|contains|all": [
      "[System.Math]::",
      "[IO.FileMode]::",
      "BinaryWriter"
    ]
  },
  "selection_header_wav": {
    "ScriptBlockText|contains|all": [
      "0x52",
      "0x49",
      "0x46",
      "0x57",
      "0x41",
      "0x56",
      "0x45",
      "0xAC"
    ]
  },
  "condition": "selection_main and 1 of selection_header_*"
}

References:
  - https://github.com/gtworek/PSBits/blob/e97cbbb173b31cbc4d37244d3412de0a114dacfb/NoDLP/bin2wav.ps1
Sigma Detection Rule: Enumerate Credentials from Windows Credential Manager With PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-20
ATT&CK techniques: T1555
Log source: windows/ps_script

Description:
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.


Detection logic:
{
  "selection_cmd": {
    "ScriptBlockText|contains|all": [
      "vaultcmd",
      "/listcreds:"
    ]
  },
  "selection_option": {
    "ScriptBlockText|contains": [
      "Windows Credentials",
      "Web Credentials"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md
Sigma Detection Rule: Suspicious Service DACL Modification Via Set-Service Cmdlet - PS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-24
ATT&CK techniques: T1574.011
Log source: windows/ps_script

Description:
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Detection logic:
{
  "selection_sddl_flag": {
    "ScriptBlockText|contains": [
      "-SecurityDescriptorSddl ",
      "-sd "
    ]
  },
  "selection_set_service": {
    "ScriptBlockText|contains|all": [
      "Set-Service ",
      "D;;"
    ],
    "ScriptBlockText|contains": [
      ";;;IU",
      ";;;SU",
      ";;;BA",
      ";;;SY",
      ";;;WD"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://twitter.com/Alh4zr3d/status/[PII_REDACTED]96828672
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
Sigma Detection Rule: Abuse of Service Permissions to Hide Services Via Set-Service - PS
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-17
ATT&CK techniques: T1574.011
Log source: windows/ps_script

Description:
Detects usage of the "Set-Service" powershell cmdlet to configure a new SecurityDescriptor that allows a service to be hidden from other utilities such as "sc.exe", "Get-Service"...etc. (Works only in powershell 7)

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Set-Service ",
      "DCLCWPDTSD"
    ],
    "ScriptBlockText|contains": [
      "-SecurityDescriptorSddl ",
      "-sd "
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/Alh4zr3d/status/[PII_REDACTED]96828672
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/set-service?view=powershell-7.2
Sigma Detection Rule: Invoke-Obfuscation Via Use Rundll32 - PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2019-10-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated Powershell via use Rundll32 in Scripts

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|contains|all": [
      "&&",
      "rundll32",
      "shell32.dll",
      "shellexec_rundll"
    ],
    "ScriptBlockText|contains": [
      "value",
      "invoke",
      "comspec",
      "iex"
    ]
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Potential Keylogger Activity
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-04
ATT&CK techniques: T1056.001
Log source: windows/ps_script

Description:
Detects PowerShell scripts that contains reference to keystroke capturing functions

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "[Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/ScumBots/status/[PII_REDACTED]57046529
  - https://www.virustotal.com/gui/file/d4486b[PII_REDACTED]6625230e0c9c81655093be93876e0d80732e7eeaf7d83476/content
  - https://www.virustotal.com/gui/file/720a7ee9f2178c70501d7e3f4bcc28a4f456e200486dbd401b25af6da3b4da62/content
  - https://learn.microsoft.com/en-us/dotnet/api/system.windows.input.keyboard.iskeydown?view=windowsdesktop-7.0