deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PowerShell Credential Prompt
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: John Lambert (idea), Florian Roth (Nextron Systems)
Date: 2017-04-09
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects PowerShell calling a credential prompt

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "PromptForCredential"
  },
  "condition": "selection"
}

References:
  - https://twitter.com/JohnLaTwC/status/[PII_REDACTED]29981184
  - https://t.co/ezOTGy1a1G
Sigma Detection Rule: Disable of ETW Trace - Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-06-28
ATT&CK techniques: T1070, T1685
Log source: windows/ps_script

Description:
Detects usage of powershell cmdlets to disable or remove ETW trace sessions

Detection logic:
{
  "selection_pwsh_remove": {
    "ScriptBlockText|contains": "Remove-EtwTraceProvider "
  },
  "selection_pwsh_set": {
    "ScriptBlockText|contains|all": [
      "Set-EtwTraceProvider ",
      "0x11"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
Sigma Detection Rule: PowerShell Remote Session Creation
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-06
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Adversaries may abuse PowerShell commands and scripts for execution.
PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-PSSession",
      "-ComputerName "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-10---powershell-invoke-downloadcradle
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-7.4
Sigma Detection Rule: PowerShell WMI Win32_Product Install MSI
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-04-24
ATT&CK techniques: T1218.007
Log source: windows/ps_script

Description:
Detects the execution of an MSI file using PowerShell and the WMI Win32_Product class

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Invoke-CimMethod ",
      "-ClassName ",
      "Win32_Product ",
      "-MethodName ",
      ".msi"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1218.007/T1218.007.md
Sigma Detection Rule: Live Memory Dump Using Powershell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Max Altgelt (Nextron Systems)
Date: 2021-09-21
ATT&CK techniques: T1003
Log source: windows/ps_script

Description:
Detects usage of a PowerShell command to dump the live memory of a Windows machine

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-StorageDiagnosticInfo",
      "-IncludeLiveDump"
    ]
  },
  "condition": "selection"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/storage/get-storagediagnosticinfo?view=windowsserver2022-ps
Sigma Detection Rule: Veeam Backup Servers Credential Dumping Script Execution
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-04
Log source: windows/ps_script

Description:
Detects execution of a PowerShell script that contains calls to the "Veeam.Backup" class, in order to dump stored credentials.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "[Credentials]",
      "[Veeam.Backup.Common.ProtectedStorage]::GetLocalString",
      "Invoke-Sqlcmd",
      "Veeam Backup and Replication"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.pwndefend.com/2021/02/15/retrieving-passwords-from-veeam-backup-servers/
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Powershell Install a DLL in System Directory
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-27
ATT&CK techniques: T1556.002
Log source: windows/ps_script

Description:
Uses PowerShell to install/copy a file into a system directory such as "System32" or "SysWOW64"

Detection logic:
{
  "selection": {
    "ScriptBlockText|re": "(Copy-Item|cpi) .{2,128} -Destination .{1,32}\\\\Windows\\\\(System32|SysWOW64)"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1556.002/T1556.002.md#atomic-test-1---install-and-register-password-filter-dll
Sigma Detection Rule: Service Registry Permissions Weakness Check
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-30
ATT&CK techniques: T1574.011
Log source: windows/ps_script

Description:
Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.
Adversaries may use flaws in the permissions for registry to redirect from the originally specified executable to one that they control, in order to launch their own code at Service start.
Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "get-acl",
      "REGISTRY::HKLM\\SYSTEM\\CurrentControlSet\\Services\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.011/T1574.011.md#atomic-test-1---service-registry-permissions-weakness
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
Sigma Detection Rule: Malicious PowerShell Keywords
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Sean Metcalf (source), Florian Roth (Nextron Systems)
Date: 2017-03-05
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects keywords from well-known PowerShell exploitation frameworks

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "AdjustTokenPrivileges",
      "IMAGE_NT_OPTIONAL_HDR64_MAGIC",
      "Metasploit",
      "Microsoft.Win32.UnsafeNativeMethods",
      "Mimikatz",
      "MiniDumpWriteDump",
      "PAGE_EXECUTE_READ",
      "ReadProcessMemory.Invoke",
      "SE_PRIVILEGE_ENABLED",
      "SECURITY_DELEGATION",
      "TOKEN_ADJUST_PRIVILEGES",
      "TOKEN_ALL_ACCESS",
      "TOKEN_ASSIGN_PRIMARY",
      "TOKEN_DUPLICATE",
      "TOKEN_ELEVATION",
      "TOKEN_IMPERSONATE",
      "TOKEN_INFORMATION_CLASS",
      "TOKEN_PRIVILEGES",
      "TOKEN_QUERY"
    ]
  },
  "condition": "selection"
}

References:
  - https://adsecurity.org/?p=2921
Sigma Detection Rule: Suspicious GPO Discovery With Get-GPO
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-06-04
ATT&CK techniques: T1615
Log source: windows/ps_script

Description:
Detect use of Get-GPO to get one GPO or all the GPOs in a domain.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Get-GPO"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1615/T1615.md
  - https://learn.microsoft.com/en-us/powershell/module/grouppolicy/get-gpo?view=windowsserver2022-ps
Sigma Detection Rule: Potential Suspicious PowerShell Keywords
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup)
Date: 2019-02-11
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "System.Reflection.Assembly.Load($",
      "[System.Reflection.Assembly]::Load($",
      "[Reflection.Assembly]::Load($",
      "System.Reflection.AssemblyName",
      "Reflection.Emit.AssemblyBuilderAccess",
      "Reflection.Emit.CustomAttributeBuilder",
      "Runtime.InteropServices.UnmanagedType",
      "Runtime.InteropServices.DllImportAttribute",
      "SuspendThread",
      "rundll32"
    ]
  },
  "condition": "selection"
}

References:
  - https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462
  - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1
  - https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1
  - https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7
Sigma Detection Rule: Extracting Information with PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-19
ATT&CK techniques: T1552.001
Log source: windows/ps_script

Description:
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
These can be files created by users to store their own credentials, shared credential stores for a group of individuals,
configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "ls",
      " -R",
      "select-string ",
      "-Pattern "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
Sigma Detection Rule: Root Certificate Installed - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: oscd.community, @redcanary, Zach Stanford @svch0st
Date: 2020-10-10
ATT&CK techniques: T1553.004
Log source: windows/ps_script

Description:
Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Detection logic:
{
  "selection1": {
    "ScriptBlockText|contains|all": [
      "Move-Item",
      "Cert:\\LocalMachine\\Root"
    ]
  },
  "selection2": {
    "ScriptBlockText|contains|all": [
      "Import-Certificate",
      "Cert:\\LocalMachine\\Root"
    ]
  },
  "condition": "1 of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.004/T1553.004.md
Sigma Detection Rule: Security Software Discovery Via Powershell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-12-16
ATT&CK techniques: T1518.001
Log source: windows/ps_script

Description:
Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes.
Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus


Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": [
      "get-process | \\?",
      "get-process | where",
      "gps | \\?",
      "gps | where"
    ]
  },
  "selection_field": {
    "ScriptBlockText|contains": [
      "Company -like",
      "Description -like",
      "Name -like",
      "Path -like",
      "Product -like"
    ]
  },
  "selection_keywords": {
    "ScriptBlockText|contains": [
      "\\*avira\\*",
      "\\*carbonblack\\*",
      "\\*cylance\\*",
      "\\*defender\\*",
      "\\*kaspersky\\*",
      "\\*malware\\*",
      "\\*sentinel\\*",
      "\\*symantec\\*",
      "\\*virus\\*"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518.001/T1518.001.md#atomic-test-2---security-software-discovery---powershell
Sigma Detection Rule: PowerShell Script With File Hostname Resolving Capabilities
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
ATT&CK techniques: T1020
Log source: windows/ps_script

Description:
Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-content ",
      "foreach",
      "[System.Net.Dns]::GetHostEntry",
      "Out-File"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.fortypoundhead.com/showcontent.asp?artid=24022
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
Sigma Detection Rule: Suspicious Mount-DiskImage
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-02-01
ATT&CK techniques: T1553.005
Log source: windows/ps_script

Description:
Adversaries may abuse container files such as disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Mount-DiskImage ",
      "-ImagePath "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1553.005/T1553.005.md#atomic-test-1---mount-iso-image
  - https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
Sigma Detection Rule: PowerShell Write-EventLog Usage
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-16
Log source: windows/ps_script

Description:
Detects usage of the "Write-EventLog" cmdlet with 'RawData' flag. The cmdlet can be levreage to write malicious payloads to the EventLog and then retrieve them later for later use

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Write-EventLog",
      "-RawData "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/
Sigma Detection Rule: Powershell Create Scheduled Task
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-28
ATT&CK techniques: T1053.005
Log source: windows/ps_script

Description:
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": [
      "New-ScheduledTaskAction",
      "New-ScheduledTaskTrigger",
      "New-ScheduledTaskPrincipal",
      "New-ScheduledTaskSettingsSet",
      "New-ScheduledTask",
      "Register-ScheduledTask"
    ]
  },
  "selection_cimmethod": {
    "ScriptBlockText|contains|all": [
      "Invoke-CimMethod",
      "-ClassName",
      "PS_ScheduledTask",
      "-NameSpace",
      "Root\\Microsoft\\Windows\\TaskScheduler"
    ]
  },
  "filter_main_legitimate_scripts": {
    "ScriptBlockText|contains|all": [
      "Microsoft.PowerShell.Core\\Export-ModuleMember",
      "Microsoft.Management.Infrastructure.CimInstance",
      "__cmdletization_methodParameter"
    ]
  },
  "condition": "1 of selection_* and not 1 of filter_main_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-4---powershell-cmdlet-scheduled-task
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1053.005/T1053.005.md#atomic-test-6---wmi-invoke-cimmethod-scheduled-task
Sigma Detection Rule: Suspicious Process Discovery With Get-Process
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-03-17
ATT&CK techniques: T1057
Log source: windows/ps_script

Description:
Get the processes that are running on the local computer.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Get-Process"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1057/T1057.md#atomic-test-3---process-discovery---get-process
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7.4
Sigma Detection Rule: Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-13
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated Powershell via VAR++ LAUNCHER

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|re": "(?i)&&set.*(\\{\\d\\}){2,}\\\\\"\\s+?-f.*&&.*cmd.*/c"
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Suspicious SSL Connection
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-01-23
ATT&CK techniques: T1573
Log source: windows/ps_script

Description:
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "System.Net.Security.SslStream",
      "Net.Security.RemoteCertificateValidationCallback",
      ".AuthenticateAsClient"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1573/T1573.md#atomic-test-1---openssl-c2
  - https://medium.com/walmartglobaltech/openssl-server-reverse-shell-from-windows-client-aee2dbfa0926
Sigma Detection Rule: NTFS Alternate Data Stream
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sami Ruohonen
Date: 2018-07-24
ATT&CK techniques: T1564.004, T1059.001
Log source: windows/ps_script

Description:
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

Detection logic:
{
  "selection_content": {
    "ScriptBlockText|contains": [
      "set-content",
      "add-content"
    ]
  },
  "selection_stream": {
    "ScriptBlockText|contains": "-stream"
  },
  "condition": "all of selection*"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]0603/http://www.powertheshell.com/ntfsstreams/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md
Sigma Detection Rule: Automated Collection Command PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-28
ATT&CK techniques: T1119
Log source: windows/ps_script

Description:
Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Detection logic:
{
  "selection_ext": {
    "ScriptBlockText|contains": [
      ".doc",
      ".docx",
      ".xls",
      ".xlsx",
      ".ppt",
      ".pptx",
      ".rtf",
      ".pdf",
      ".txt"
    ]
  },
  "selection_cmd": {
    "ScriptBlockText|contains|all": [
      "Get-ChildItem",
      " -Recurse ",
      " -Include "
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md
Sigma Detection Rule: Powershell Directory Enumeration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-03-17
ATT&CK techniques: T1083
Log source: windows/ps_script

Description:
Detects technique used by MAZE ransomware to enumerate directories using Powershell

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "foreach",
      "Get-ChildItem",
      "-Path ",
      "-ErrorAction ",
      "SilentlyContinue",
      "Out-File ",
      "-append"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
  - https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
Sigma Detection Rule: Suspicious PowerShell Mailbox Export to Share - PS
Repository: SigmaHQ/sigma
Severity: critical
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-26
Log source: windows/ps_script

Description:
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-MailboxExportRequest",
      " -Mailbox ",
      " -FilePath \\\\\\\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://youtu.be/5mqid-7zp8k?t=2481
  - https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html
  - https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
  - https://m365internals.com/2022/10/07/hunting-in-on-premises-exchange-server-logs/
Sigma Detection Rule: Suspicious New-PSDrive to Admin Share
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-13
ATT&CK techniques: T1021.002
Log source: windows/ps_script

Description:
Adversaries may use to interact with a remote network share using Server Message Block (SMB). The adversary may then perform actions as the logged-on user.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-PSDrive",
      "-psprovider ",
      "filesystem",
      "-root ",
      "\\\\\\\\",
      "$"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/new-psdrive?view=powershell-7.2
Sigma Detection Rule: PowerShell Get-Process LSASS in ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-04-23
ATT&CK techniques: T1003.001
Log source: windows/ps_script

Description:
Detects a Get-Process command on lsass process, which is in almost all cases a sign of malicious activity

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Get-Process lsass"
  },
  "condition": "selection"
}

References:
  - https://web.archive.org/web/[PII_REDACTED]3028/https://twitter.com/PythonResponder/status/[PII_REDACTED]49630211
Sigma Detection Rule: Recon Information for Export with PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-07-30
ATT&CK techniques: T1119
Log source: windows/ps_script

Description:
Once established within a system or network, an adversary may use automated techniques for collecting internal data

Detection logic:
{
  "selection_action": {
    "ScriptBlockText|contains": [
      "Get-Service ",
      "Get-ChildItem ",
      "Get-Process "
    ]
  },
  "selection_redirect": {
    "ScriptBlockText|contains": "> $env:TEMP\\"
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1119/T1119.md