deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: PowerShell ShellCode
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: David Ledbetter (shellcode), Florian Roth (Nextron Systems)
Date: 2018-11-17
ATT&CK techniques: T1055, T1059.001
Log source: windows/ps_script

Description:
Detects Base64 encoded Shellcode

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "OiCAAAAYInlM",
      "OiJAAAAYInlM"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]92523776
Sigma Detection Rule: Potential Suspicious Windows Feature Enabled
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-09-10
Log source: windows/ps_script

Description:
Detects usage of the built-in PowerShell cmdlet "Enable-WindowsOptionalFeature" used as a Deployment Image Servicing and Management tool.
Similar to DISM.exe, this cmdlet is used to enumerate, install, uninstall, configure, and update features and packages in Windows images


Detection logic:
{
  "selection_cmd": {
    "ScriptBlockText|contains|all": [
      "Enable-WindowsOptionalFeature",
      "-Online",
      "-FeatureName"
    ]
  },
  "selection_feature": {
    "ScriptBlockText|contains": [
      "TelnetServer",
      "Internet-Explorer-Optional-amd64",
      "TFTP",
      "SMB1Protocol",
      "Client-ProjFS",
      "Microsoft-Windows-Subsystem-Linux"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
  - https://learn.microsoft.com/en-us/windows/win32/projfs/enabling-windows-projected-file-system
  - https://learn.microsoft.com/en-us/windows/wsl/install-on-server
Sigma Detection Rule: Zip A Folder With PowerShell For Staging In Temp - PowerShell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2021-07-20
ATT&CK techniques: T1074.001
Log source: windows/ps_script

Description:
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration.
An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Compress-Archive -Path*-DestinationPath $env:TEMP",
      "Compress-Archive -Path*-DestinationPath*\\AppData\\Local\\Temp\\",
      "Compress-Archive -Path*-DestinationPath*:\\Windows\\Temp\\"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1074.001/T1074.001.md
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
Sigma Detection Rule: Certificate Exported Via PowerShell - ScriptBlock
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2021-04-23
ATT&CK techniques: T1552.004
Log source: windows/ps_script

Description:
Detects calls to cmdlets inside of PowerShell scripts that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Export-PfxCertificate",
      "Export-Certificate"
    ]
  },
  "filter_optional_module_export": {
    "ScriptBlockText|contains": "CmdletsToExport = @("
  },
  "condition": "selection and not 1 of filter_optional_*"
}

References:
  - https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a
  - https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps
  - https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html
Sigma Detection Rule: Suspicious PowerShell Get Current User
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-04-04
ATT&CK techniques: T1033
Log source: windows/ps_script

Description:
Detects the use of PowerShell to identify the current logged user.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "[System.Environment]::UserName",
      "$env:UserName",
      "[System.Security.Principal.WindowsIdentity]::GetCurrent()"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-4---user-discovery-with-env-vars-powershell-script
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1033/T1033.md#atomic-test-5---getcurrent-user-with-powershell-script
Sigma Detection Rule: PowerShell Create Local User
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: @ROxPinTeddy
Date: 2020-04-11
ATT&CK techniques: T1059.001, T1136.001
Log source: windows/ps_script

Description:
Detects creation of a local user via PowerShell

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "New-LocalUser"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
Sigma Detection Rule: Registry-Free Process Scope COR_PROFILER
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-30
ATT&CK techniques: T1574.012
Log source: windows/ps_script

Description:
Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.
The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).
These profiliers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.
(Citation: Microsoft Profiling Mar 2017)
(Citation: Microsoft COR_PROFILER Feb 2013)


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "$env:COR_ENABLE_PROFILING",
      "$env:COR_PROFILER",
      "$env:COR_PROFILER_PATH"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1574.012/T1574.012.md#atomic-test-3---registry-free-process-scope-cor_profiler
Sigma Detection Rule: Winlogon Helper DLL
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2019-10-21
ATT&CK techniques: T1547.004
Log source: windows/ps_script

Description:
Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.
Registry entries in HKLM\Software[Wow6432Node]Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are
used to manage additional helper programs and functionalities that support Winlogon. Malicious modifications to these Registry keys may cause Winlogon to
load and execute malicious DLLs and/or executables.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "CurrentVersion\\Winlogon"
  },
  "selection2": {
    "ScriptBlockText|contains": [
      "Set-ItemProperty",
      "New-Item"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1547.004/T1547.004.md
Sigma Detection Rule: HackTool - Rubeus Execution - ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Christian Burkard (Nextron Systems), Florian Roth (Nextron Systems)
Date: 2023-04-27
ATT&CK techniques: T1003, T1558.003, T1550.003
Log source: windows/ps_script

Description:
Detects the execution of the hacktool Rubeus using specific command line flags

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "asreproast ",
      "dump /service:krbtgt ",
      "dump /luid:0x",
      "kerberoast ",
      "createnetonly /program:",
      "ptt /ticket:",
      "/impersonateuser:",
      "renew /ticket:",
      "asktgt /user:",
      "harvest /interval:",
      "s4u /user:",
      "s4u /ticket:",
      "hash /password:",
      "golden /aes256:",
      "silver /user:"
    ]
  },
  "condition": "selection"
}

References:
  - https://blog.harmj0y.net/redteaming/from-kekeo-to-rubeus
  - https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html
  - https://github.com/GhostPack/Rubeus
Sigma Detection Rule: Tamper Windows Defender - ScriptBlockLogging
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113, elhoim, Tim Shelton (fps, alias support), Swachchhanda Shrawan Poudel, Nasreddine Bencherchali (Nextron Systems)
Date: 2022-01-16
ATT&CK techniques: T1685
Log source: windows/ps_script

Description:
Detects PowerShell scripts attempting to disable scheduled scanning and other parts of Windows Defender ATP or set default actions to allow.

Detection logic:
{
  "selection_options_disabling_preference": {
    "ScriptBlockText|contains": "Set-MpPreference"
  },
  "selection_options_disabling_function": {
    "ScriptBlockText|contains": [
      "-dbaf $true",
      "-dbaf 1",
      "-dbm $true",
      "-dbm 1",
      "-dips $true",
      "-dips 1",
      "-DisableArchiveScanning $true",
      "-DisableArchiveScanning 1",
      "-DisableBehaviorMonitoring $true",
      "-DisableBehaviorMonitoring 1",
      "-DisableBlockAtFirstSeen $true",
      "-DisableBlockAtFirstSeen 1",
      "-DisableCatchupFullScan $true",
      "-DisableCatchupFullScan 1",
      "-DisableCatchupQuickScan $true",
      "-DisableCatchupQuickScan 1",
      "-DisableIntrusionPreventionSystem $true",
      "-DisableIntrusionPreventionSystem 1",
      "-DisableIOAVProtection $true",
      "-DisableIOAVProtection 1",
      "-DisableRealtimeMonitoring $true",
      "-DisableRealtimeMonitoring 1",
      "-DisableRemovableDriveScanning $true",
      "-DisableRemovableDriveScanning 1",
      "-DisableScanningMappedNetworkDrivesForFullScan $true",
      "-DisableScanningMappedNetworkDrivesForFullScan 1",
      "-DisableScanningNetworkFiles $true",
      "-DisableScanningNetworkFiles 1",
      "-DisableScriptScanning $true",
      "-DisableScriptScanning 1",
      "-MAPSReporting $false",
      "-MAPSReporting 0",
      "-drdsc $true",
      "-drdsc 1",
      "-drtm $true",
      "-drtm 1",
      "-dscrptsc $true",
      "-dscrptsc 1",
      "-dsmndf $true",
      "-dsmn

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1562.001/T1562.001.md
  - https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps
  - https://bidouillesecurity.com/disable-windows-defender-in-powershell/
Sigma Detection Rule: Detected Windows Software Discovery - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-16
ATT&CK techniques: T1518
Log source: windows/ps_script

Description:
Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "get-itemProperty",
      "\\software\\",
      "select-object",
      "format-table"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md
  - https://github.com/harleyQu1nn/AggressorScripts
Sigma Detection Rule: Dump Credentials from Windows Credential Manager With PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-12-20
ATT&CK techniques: T1555
Log source: windows/ps_script

Description:
Adversaries may search for common password storage locations to obtain user credentials.
Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.


Detection logic:
{
  "selection_kiddie": {
    "ScriptBlockText|contains": [
      "Get-PasswordVaultCredentials",
      "Get-CredManCreds"
    ]
  },
  "selection_rename_Password": {
    "ScriptBlockText|contains|all": [
      "New-Object",
      "Windows.Security.Credentials.PasswordVault"
    ]
  },
  "selection_rename_credman": {
    "ScriptBlockText|contains|all": [
      "New-Object",
      "Microsoft.CSharp.CSharpCodeProvider",
      "[System.Runtime.InteropServices.RuntimeEnvironment]::GetRuntimeDirectory())",
      "Collections.ArrayList",
      "System.CodeDom.Compiler.CompilerParameters"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555/T1555.md
Sigma Detection Rule: PowerShell PSAttack
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Sean Metcalf (source), Florian Roth (Nextron Systems)
Date: 2017-03-05
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects the use of PSAttack PowerShell hack tool

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "PS ATTACK!!!"
  },
  "condition": "selection"
}

References:
  - https://adsecurity.org/?p=2921
Sigma Detection Rule: Invoke-Obfuscation Via Use MSHTA - PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nikita Nazarov, oscd.community
Date: 2020-10-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated Powershell via use MSHTA in Scripts

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|contains|all": [
      "set",
      "&&",
      "mshta",
      "vbscript:createobject",
      ".run",
      "(window.close)"
    ]
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Daniel Bohannon (@Mandiant/@FireEye), oscd.community
Date: 2019-11-08
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

Detection logic:
{
  "selection_iex": [
    {
      "ScriptBlockText|re": "\\$PSHome\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$PSHome\\["
    },
    {
      "ScriptBlockText|re": "\\$ShellId\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$ShellId\\["
    },
    {
      "ScriptBlockText|re": "\\$env:Public\\[\\s*\\d{1,3}\\s*\\]\\s*\\+\\s*\\$env:Public\\["
    },
    {
      "ScriptBlockText|re": "\\$env:ComSpec\\[(\\s*\\d{1,3}\\s*,){2}"
    },
    {
      "ScriptBlockText|re": "\\*mdr\\*\\W\\s*\\)\\.Name"
    },
    {
      "ScriptBlockText|re": "\\$VerbosePreference\\.ToString\\("
    }
  ],
  "condition": "selection_iex"
}

References:
  - https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888
Sigma Detection Rule: Suspicious TCP Tunnel Via PowerShell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-07-08
ATT&CK techniques: T1090
Log source: windows/ps_script

Description:
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "[System.Net.HttpWebRequest]",
      "System.Net.Sockets.TcpListener",
      "AcceptTcpClient"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/Arno0x/PowerShellScripts/blob/a6b7d5490fbf0b20f91195838f3a11156724b4f7/proxyTunnel.ps1
Sigma Detection Rule: Suspicious Eventlog Clear
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2022-09-12
ATT&CK techniques: T1685.005
Log source: windows/ps_script

Description:
Detects usage of known powershell cmdlets such as "Clear-EventLog" to clear the Windows event logs

Detection logic:
{
  "selection": [
    {
      "ScriptBlockText|contains": [
        "Clear-EventLog ",
        "Remove-EventLog ",
        "Limit-EventLog ",
        "Clear-WinEvent "
      ]
    },
    {
      "ScriptBlockText|contains|all": [
        "Eventing.Reader.EventLogSession",
        "ClearLog"
      ]
    },
    {
      "ScriptBlockText|contains|all": [
        "Diagnostics.EventLog",
        "Clear"
      ]
    }
  ],
  "condition": "selection"
}

References:
  - https://twitter.com/oroneequalsone/status/[PII_REDACTED]61830402
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.001/T1070.001.md
  - https://eqllib.readthedocs.io/en/latest/analytics/5b223758-07d6-4100-9e11-238cfdd0fe97.html
  - https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
  - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
Sigma Detection Rule: Powershell Timestomp
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-08-03
ATT&CK techniques: T1070.006
Log source: windows/ps_script

Description:
Adversaries may modify file time attributes to hide new or changes to existing files.
Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.


Detection logic:
{
  "selection_ioc": {
    "ScriptBlockText|contains": [
      ".CreationTime =",
      ".LastWriteTime =",
      ".LastAccessTime =",
      "[IO.File]::SetCreationTime",
      "[IO.File]::SetLastAccessTime",
      "[IO.File]::SetLastWriteTime"
    ]
  },
  "condition": "selection_ioc"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1070.006/T1070.006.md
  - https://www.offensive-security.com/metasploit-unleashed/timestomp/
Sigma Detection Rule: PowerShell Web Access Installation - PsScript
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Michael Haag
Date: 2024-09-03
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse

Detection logic:
{
  "selection_install": {
    "ScriptBlockText|contains": "Install-WindowsFeature WindowsPowerShellWebAccess"
  },
  "selection_config": {
    "ScriptBlockText|contains": "Install-PswaWebApplication"
  },
  "selection_auth": {
    "ScriptBlockText|contains|all": [
      "Add-PswaAuthorizationRule",
      "-UserName *",
      "-ComputerName *"
    ]
  },
  "condition": "1 of selection_*"
}

References:
  - https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication
  - https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
  - https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
Sigma Detection Rule: Powershell DNSExfiltration
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: frack113
Date: 2022-01-07
ATT&CK techniques: T1048
Log source: windows/ps_script

Description:
DNSExfiltrator allows for transferring (exfiltrate) a file over a DNS request covert channel

Detection logic:
{
  "selection_cmdlet": [
    {
      "ScriptBlockText|contains": "Invoke-DNSExfiltrator"
    },
    {
      "ScriptBlockText|contains|all": [
        " -i ",
        " -d ",
        " -p ",
        " -doh ",
        " -t "
      ]
    }
  ],
  "condition": "selection_cmdlet"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048/T1048.md#atomic-test-3---dnsexfiltration-doh
  - https://github.com/Arno0x/DNSExfiltrator
Sigma Detection Rule: Potential Persistence Via PowerShell User Profile Using Add-Content
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Nasreddine Bencherchali (Nextron Systems)
Date: 2021-08-18
ATT&CK techniques: T1546.013
Log source: windows/ps_script

Description:
Detects calls to "Add-Content" cmdlet in order to modify the content of the user profile and potentially adding suspicious commands for persistence

Detection logic:
{
  "selection_add": {
    "ScriptBlockText|contains": "Add-Content $profile"
  },
  "selection_options": {
    "ScriptBlockText|contains": [
      "-Value \"IEX ",
      "-Value \"Invoke-Expression",
      "-Value \"Invoke-WebRequest",
      "-Value \"Start-Process",
      "-Value 'IEX ",
      "-Value 'Invoke-Expression",
      "-Value 'Invoke-WebRequest",
      "-Value 'Start-Process"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.013/T1546.013.md
Sigma Detection Rule: Change User Agents with WebRequest
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-23
ATT&CK techniques: T1071.001
Log source: windows/ps_script

Description:
Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.
Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.


Detection logic:
{
  "selection_webrequest": {
    "ScriptBlockText|contains": [
      "Invoke-WebRequest",
      "Invoke-RestMethod",
      " irm ",
      "iwr "
    ]
  },
  "selection_useragent": {
    "ScriptBlockText|contains": "-UserAgent "
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1071.001/T1071.001.md#t1071001---web-protocols
Sigma Detection Rule: Potential COM Objects Download Cradles Usage - PS Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-25
ATT&CK techniques: T1105
Log source: windows/ps_script

Description:
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID

Detection logic:
{
  "selection_1": {
    "ScriptBlockText|contains": "[Type]::GetTypeFromCLSID("
  },
  "selection_2": {
    "ScriptBlockText|contains": [
      "0002DF01-0000-0000-C[PII_REDACTED]00046",
      "F6D90F16-9C73-11D3-B32E-00C04F990BB4",
      "F5078F35-C551-11D3-89B9-0000F81FE221",
      "88d96a0a-f192-11d4-a65f[PII_REDACTED]e5",
      "AFBA6B42-5692-48EA-8141-DC517DCF0EF1",
      "AFB40FFD-B609-40A3-9828-F88BBE11E4E3",
      "88d96a0b-f192-11d4-a65f[PII_REDACTED]e5",
      "2087c2f4-2cef-4953-a8ab-66779b670495",
      "000209FF-0000-0000-C[PII_REDACTED]00046",
      "[PII_REDACTED]-C[PII_REDACTED]00046"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/dotnet/api/system.type.gettypefromclsid?view=net-7.0
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=57