deardaniel/secdata-raw huggingface dataset:
Sigma Detection Rule: Suspicious FromBase64String Usage On Gzip Archive - Ps Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-12-23
ATT&CK techniques: T1132.001
Log source: windows/ps_script

Description:
Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "FromBase64String",
      "MemoryStream",
      "H4sI"
    ]
  },
  "condition": "selection"
}

References:
  - https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=43
Sigma Detection Rule: Modify Group Policy Settings - ScriptBlockLogging
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-08-19
ATT&CK techniques: T1484.001
Log source: windows/ps_script

Description:
Detect malicious GPO modifications can be used to implement many other malicious behaviors.

Detection logic:
{
  "selection_path": {
    "ScriptBlockText|contains": "\\SOFTWARE\\Policies\\Microsoft\\Windows\\System"
  },
  "selection_key": {
    "ScriptBlockText|contains": [
      "GroupPolicyRefreshTimeDC",
      "GroupPolicyRefreshTimeOffsetDC",
      "GroupPolicyRefreshTime",
      "GroupPolicyRefreshTimeOffset",
      "EnableSmartScreen",
      "ShellSmartScreenLevel"
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb[PII_REDACTED]6735a1fd15/atomics/T1484.001/T1484.001.md
Sigma Detection Rule: WMImplant Hack Tool
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: NVISO
Date: 2020-03-26
ATT&CK techniques: T1047, T1059.001
Log source: windows/ps_script

Description:
Detects parameters used by WMImplant

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "WMImplant",
      " change_user ",
      " gen_cli ",
      " command_exec ",
      " disable_wdigest ",
      " disable_winrm ",
      " enable_wdigest ",
      " enable_winrm ",
      " registry_mod ",
      " remote_posh ",
      " sched_job ",
      " service_mod ",
      " process_kill ",
      " active_users ",
      " basic_info ",
      " power_off ",
      " vacant_system ",
      " logon_events "
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/FortyNorthSecurity/WMImplant
Sigma Detection Rule: Active Directory Computers Enumeration With Get-AdComputer
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-03-17
ATT&CK techniques: T1018, T1087.002
Log source: windows/ps_script

Description:
Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains": "Get-AdComputer "
  },
  "selection_option": {
    "ScriptBlockText|contains": [
      "-Filter ",
      "-LDAPFilter ",
      "-Properties "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-adcomputer
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md
  - https://github.com/redcanaryco/atomic-red-team/blob/02cb591f75064ffe1e0df9ac3ed5972a2e491c97/atomics/T1087.002/T1087.002.md
Sigma Detection Rule: Password Policy Discovery With Get-AdDefaultDomainPasswordPolicy
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2022-03-17
ATT&CK techniques: T1201
Log source: windows/ps_script

Description:
Detetcts PowerShell activity in which Get-Addefaultdomainpasswordpolicy is used to get the default password policy for an Active Directory domain.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": "Get-AdDefaultDomainPasswordPolicy"
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1201/T1201.md#atomic-test-9---enumerate-active-directory-password-policy-with-get-addefaultdomainpasswordpolicy
  - https://learn.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2022-ps
Sigma Detection Rule: Automated Collection Bookmarks Using Get-ChildItem PowerShell
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-13
ATT&CK techniques: T1217
Log source: windows/ps_script

Description:
Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
internal network resources such as servers, tools/dashboards, or other related infrastructure.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-ChildItem",
      " -Recurse ",
      " -Path ",
      " -Filter Bookmarks",
      " -ErrorAction SilentlyContinue",
      " -Force"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1217/T1217.md
Sigma Detection Rule: Deletion of Volume Shadow Copies via WMI with PowerShell - PS Script
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Tim Rauch, frack113
Date: 2022-09-20
ATT&CK techniques: T1490
Log source: windows/ps_script

Description:
Detects deletion of Windows Volume Shadow Copies with PowerShell code and Get-WMIObject. This technique is used by numerous ransomware families such as Sodinokibi/REvil

Detection logic:
{
  "selection_get": {
    "ScriptBlockText|contains": [
      "Get-WmiObject",
      "gwmi",
      "Get-CimInstance",
      "gcim"
    ]
  },
  "selection_shadowcopy": {
    "ScriptBlockText|contains": "Win32_ShadowCopy"
  },
  "selection_delete": {
    "ScriptBlockText|contains": [
      ".Delete()",
      "Remove-WmiObject",
      "rwmi",
      "Remove-CimInstance",
      "rcim"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1490/T1490.md#atomic-test-5---windows---delete-volume-shadow-copies-via-wmi-with-powershell
  - https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deletion-via-powershell.html
Sigma Detection Rule: Execute Invoke-command on Remote Host
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-01-07
ATT&CK techniques: T1021.006
Log source: windows/ps_script

Description:
Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM). The adversary may then perform actions as the logged-on user.

Detection logic:
{
  "selection_cmdlet": {
    "ScriptBlockText|contains|all": [
      "invoke-command ",
      " -ComputerName "
    ]
  },
  "condition": "selection_cmdlet"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.006/T1021.006.md#atomic-test-2---invoke-command
  - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.4
Sigma Detection Rule: Suspicious Get-ADReplAccount
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2022-02-06
ATT&CK techniques: T1003.006
Log source: windows/ps_script

Description:
The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory.
These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-ADReplAccount",
      "-All ",
      "-Server "
    ]
  },
  "condition": "selection"
}

References:
  - https://www.powershellgallery.com/packages/DSInternals
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.006/T1003.006.md#atomic-test-2---run-dsinternals-get-adreplaccount
Sigma Detection Rule: AMSI Bypass Pattern Assembly GetType
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2022-11-09
ATT&CK techniques: T1685
Log source: windows/ps_script

Description:
Detects code fragments found in small and obfuscated AMSI bypass PowerShell scripts

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "[Ref].Assembly.GetType",
      "SetValue($null,$true)",
      "NonPublic,Static"
    ]
  },
  "condition": "selection"
}

References:
  - https://www.mdsec.co.uk/2018/06/exploring-powershell-amsi-and-logging-evasion/
  - https://twitter.com/cyb3rops/status/[PII_REDACTED]57979905?s=20&t=A7hh93ONM7ni1Rj1jO5OaA
Sigma Detection Rule: Disable Powershell Command History
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Ali Alwashali
Date: 2022-08-21
ATT&CK techniques: T1070.003
Log source: windows/ps_script

Description:
Detects scripts or commands that disabled the Powershell command history by removing psreadline module

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Remove-Module",
      "psreadline"
    ]
  },
  "condition": "selection"
}

References:
  - https://twitter.com/DissectMalware/status/[PII_REDACTED]49773824
Sigma Detection Rule: Powershell WMI Persistence
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113
Date: 2021-08-19
ATT&CK techniques: T1546.003
Log source: windows/ps_script

Description:
Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Detection logic:
{
  "selection_ioc": [
    {
      "ScriptBlockText|contains|all": [
        "New-CimInstance ",
        "-Namespace root/subscription ",
        "-ClassName __EventFilter ",
        "-Property "
      ]
    },
    {
      "ScriptBlockText|contains|all": [
        "New-CimInstance ",
        "-Namespace root/subscription ",
        "-ClassName CommandLineEventConsumer ",
        "-Property "
      ]
    }
  ],
  "condition": "selection_ioc"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.003/T1546.003.md
  - https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/data/module_source/persistence/Persistence.psm1#L545
Sigma Detection Rule: Potential Persistence Via Security Descriptors - ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-05
Log source: windows/ps_script

Description:
Detects usage of certain functions and keywords that are used to manipulate security descriptors in order to potentially set a backdoor. As seen used in the DAMP project.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "win32_Trustee",
      "win32_Ace",
      ".AccessMask",
      ".AceType",
      ".SetSecurityDescriptor"
    ],
    "ScriptBlockText|contains": [
      "\\Lsa\\JD",
      "\\Lsa\\Skew1",
      "\\Lsa\\Data",
      "\\Lsa\\GBG"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/HarmJ0y/DAMP
Sigma Detection Rule: Suspicious PowerShell Download - Powershell Script
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Florian Roth (Nextron Systems)
Date: 2017-03-05
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects suspicious PowerShell download command

Detection logic:
{
  "webclient": {
    "ScriptBlockText|contains": "System.Net.WebClient"
  },
  "download": {
    "ScriptBlockText|contains": [
      ".DownloadFile(",
      ".DownloadFileAsync(",
      ".DownloadString(",
      ".DownloadStringAsync("
    ]
  },
  "condition": "webclient and download"
}

References:
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0
  - https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0
Sigma Detection Rule: PowerShell ICMP Exfiltration
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Bartlomiej Czyz @bczyz1, oscd.community
Date: 2020-10-10
ATT&CK techniques: T1048.003
Log source: windows/ps_script

Description:
Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "New-Object",
      "System.Net.NetworkInformation.Ping",
      ".Send("
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1048.003/T1048.003.md#atomic-test-2---exfiltration-over-alternative-protocol---icmp
Sigma Detection Rule: AADInternals PowerShell Cmdlets Execution - PsScript
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer (@austinsonger), Nasreddine Bencherchali (Nextron Systems), Swachchhanda Shrawan Poudel (Nextron Systems)
Date: 2022-12-23
Log source: windows/ps_script

Description:
Detects ADDInternals Cmdlet execution. A tool for administering Azure AD and Office 365. Which can be abused by threat actors to attack Azure AD or Office 365.

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Add-AADInt",
      "ConvertTo-AADInt",
      "Disable-AADInt",
      "Enable-AADInt",
      "Export-AADInt",
      "Find-AADInt",
      "Get-AADInt",
      "Grant-AADInt",
      "Initialize-AADInt",
      "Install-AADInt",
      "Invoke-AADInt",
      "Join-AADInt",
      "New-AADInt",
      "Open-AADInt",
      "Read-AADInt",
      "Register-AADInt",
      "Remove-AADInt",
      "Reset-AADInt",
      "Resolve-AADInt",
      "Restore-AADInt",
      "Save-AADInt",
      "Search-AADInt",
      "Send-AADInt",
      "Set-AADInt",
      "Start-AADInt",
      "Unprotect-AADInt",
      "Update-AADInt"
    ]
  },
  "condition": "selection"
}

References:
  - https://o365blog.com/aadinternals/
  - https://github.com/Gerenios/AADInternals
Sigma Detection Rule: Powershell Detect Virtualization Environment
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Duc.Le-GTSC
Date: 2021-08-03
ATT&CK techniques: T1497.001
Log source: windows/ps_script

Description:
Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.
This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox


Detection logic:
{
  "selection_action": {
    "ScriptBlockText|contains": [
      "Get-WmiObject",
      "gwmi"
    ]
  },
  "selection_module": {
    "ScriptBlockText|contains": [
      "MSAcpi_ThermalZoneTemperature",
      "Win32_ComputerSystem"
    ]
  },
  "condition": "all of selection*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1497.001/T1497.001.md
  - https://techgenix.com/malicious-powershell-scripts-evade-detection/
Sigma Detection Rule: Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Timur Zinniatullin, oscd.community
Date: 2020-10-18
ATT&CK techniques: T1027, T1059.001
Log source: windows/ps_script

Description:
Detects Obfuscated Powershell via RUNDLL LAUNCHER

Detection logic:
{
  "selection_4104": {
    "ScriptBlockText|contains|all": [
      "rundll32.exe",
      "shell32.dll",
      "shellexec_rundll",
      "powershell"
    ]
  },
  "condition": "selection_4104"
}

References:
  - https://github.com/SigmaHQ/sigma/issues/1009
Sigma Detection Rule: DSInternals Suspicious PowerShell Cmdlets - ScriptBlock
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2024-06-26
ATT&CK techniques: T1059.001
Log source: windows/ps_script

Description:
Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files.
The DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "Add-ADDBSidHistory",
      "Add-ADNgcKey",
      "Add-ADReplNgcKey",
      "ConvertFrom-ADManagedPasswordBlob",
      "ConvertFrom-GPPrefPassword",
      "ConvertFrom-ManagedPasswordBlob",
      "ConvertFrom-UnattendXmlPassword",
      "ConvertFrom-UnicodePassword",
      "ConvertTo-AADHash",
      "ConvertTo-GPPrefPassword",
      "ConvertTo-KerberosKey",
      "ConvertTo-LMHash",
      "ConvertTo-MsoPasswordHash",
      "ConvertTo-NTHash",
      "ConvertTo-OrgIdHash",
      "ConvertTo-UnicodePassword",
      "Disable-ADDBAccount",
      "Enable-ADDBAccount",
      "Get-ADDBAccount",
      "Get-ADDBBackupKey",
      "Get-ADDBDomainController",
      "Get-ADDBGroupManagedServiceAccount",
      "Get-ADDBKdsRootKey",
      "Get-ADDBSchemaAttribute",
      "Get-ADDBServiceAccount",
      "Get-ADDefaultPasswordPolicy",
      "Get-ADKeyCredential",
      "Get-ADPasswordPolicy",
      "Get-ADReplAccount",
      "Get-ADReplBackupKey",
      "Get-ADReplicationAccount",
      "Get-ADSIAccount",
      "Get-AzureADUserEx",
      "Get-BootKey",
      "Get-KeyCredential",
      "Get-LsaBackupKey",
      "Get-LsaPolicy",
      "Get-SamPasswordPolicy",
      "Get-SysKey",
      "Get-SystemKey",
      "New-ADDBRestoreFromMediaScript",
      "New-ADKeyCredential",
      "New-ADNgcKey",
      "New-NTHashSet",
      "Remove-ADDBObject",
      "Save-DPAPIBlob",
      "Set-ADAccountPasswordHash",
      "Set-ADDBAccountPassword",
      "S

References:
  - https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.PowerShell/DSInternals.psd1
Sigma Detection Rule: Replace Desktop Wallpaper by Powershell
Repository: SigmaHQ/sigma
Severity: low
Status: test
Author: frack113
Date: 2021-12-26
ATT&CK techniques: T1491.001
Log source: windows/ps_script

Description:
An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users.
This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper


Detection logic:
{
  "selection_1": {
    "ScriptBlockText|contains|all": [
      "Get-ItemProperty",
      "Registry::",
      "HKEY_CURRENT_USER\\Control Panel\\Desktop\\",
      "WallPaper"
    ]
  },
  "selection_2": {
    "ScriptBlockText|contains": "SystemParametersInfo(20,0,*,3)"
  },
  "condition": "1 of selection_*"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1491.001/T1491.001.md
Sigma Detection Rule: Computer Discovery And Export Via Get-ADComputer Cmdlet - PowerShell
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-11-17
ATT&CK techniques: T1033
Log source: windows/ps_script

Description:
Detects usage of the Get-ADComputer cmdlet to collect computer information and output it to a file

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "Get-ADComputer ",
      " -Filter \\*"
    ],
    "ScriptBlockText|contains": [
      " | Select ",
      "Out-File",
      "Set-Content",
      "Add-Content"
    ]
  },
  "condition": "selection"
}

References:
  - http://blog.talosintelligence.com/2022/09/lazarus-three-rats.html
  - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
  - https://www.cisa.gov/uscert/sites/default/files/publications/aa22-320a_joint_csa_iranian_government-sponsored_apt_actors_compromise_federal%20network_deploy_crypto%20miner_credential_harvester.pdf
Sigma Detection Rule: Tamper Windows Defender Remove-MpPreference - ScriptBlockLogging
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-08-05
ATT&CK techniques: T1685
Log source: windows/ps_script

Description:
Detects attempts to remove Windows Defender configuration using the 'MpPreference' cmdlet

Detection logic:
{
  "selection_remove": {
    "ScriptBlockText|contains": "Remove-MpPreference"
  },
  "selection_tamper": {
    "ScriptBlockText|contains": [
      "-ControlledFolderAccessProtectedFolders ",
      "-AttackSurfaceReductionRules_Ids ",
      "-AttackSurfaceReductionRules_Actions ",
      "-CheckForSignaturesBeforeRunningScan "
    ]
  },
  "condition": "all of selection_*"
}

References:
  - https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/windows-10-controlled-folder-access-event-search/ba-p/2326088
Sigma Detection Rule: Suspicious PowerShell WindowStyle Option
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: frack113, Tim Shelton (fp AWS)
Date: 2021-10-20
ATT&CK techniques: T1564.003
Log source: windows/ps_script

Description:
Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.
In some cases, windows that would typically be displayed when an application carries out an operation can be hidden


Detection logic:
{
  "selection": {
    "ScriptBlockText|contains|all": [
      "powershell",
      "WindowStyle",
      "Hidden"
    ]
  },
  "filter": {
    "ScriptBlockText|contains|all": [
      ":\\Program Files\\Amazon\\WorkSpacesConfig\\Scripts\\",
      "$PSScriptRoot\\Module\\WorkspaceScriptModule\\WorkspaceScriptModule"
    ]
  },
  "condition": "selection and not filter"
}

References:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.003/T1564.003.md
Sigma Detection Rule: Clearing Windows Console History
Repository: SigmaHQ/sigma
Severity: high
Status: test
Author: Austin Songer @austinsonger
Date: 2021-11-25
ATT&CK techniques: T1070, T1070.003
Log source: windows/ps_script

Description:
Identifies when a user attempts to clear console history. An adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Detection logic:
{
  "selection1": {
    "ScriptBlockText|contains": "Clear-History"
  },
  "selection2a": {
    "ScriptBlockText|contains": [
      "Remove-Item",
      "rm"
    ]
  },
  "selection2b": {
    "ScriptBlockText|contains": [
      "ConsoleHost_history.txt",
      "(Get-PSReadlineOption).HistorySavePath"
    ]
  },
  "condition": "selection1 or selection2a and selection2b"
}

References:
  - https://stefanos.cloud/blog/kb/how-to-clear-the-powershell-command-history/
  - https://www.shellhacks.com/clear-history-powershell/
  - https://community.sophos.com/sophos-labs/b/blog/posts/powershell-command-history-forensics
Sigma Detection Rule: Potential AMSI Bypass Script Using NULL Bits
Repository: SigmaHQ/sigma
Severity: medium
Status: test
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-04
ATT&CK techniques: T1685
Log source: windows/ps_script

Description:
Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities

Detection logic:
{
  "selection": {
    "ScriptBlockText|contains": [
      "if(0){{{0}}}' -f $(0 -as [char]) +",
      "#<NULL>"
    ]
  },
  "condition": "selection"
}

References:
  - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi