Detectionmediumtest

Potential Suspicious PowerShell Keywords

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems), Perez Diego, Tuan Le (NCSGroup)Created Mon Feb 11Updated Fri Apr 211f49f2ab-26bc-48b3-96cc-dcffbc93eadfwindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        ScriptBlockText|contains:
            - 'System.Reflection.Assembly.Load($'
            - '[System.Reflection.Assembly]::Load($'
            - '[Reflection.Assembly]::Load($'
            - 'System.Reflection.AssemblyName'
            - 'Reflection.Emit.AssemblyBuilderAccess'
            - 'Reflection.Emit.CustomAttributeBuilder'
            - 'Runtime.InteropServices.UnmanagedType'
            - 'Runtime.InteropServices.DllImportAttribute'
            - 'SuspendThread'
            - 'rundll32'
            # - 'FromBase64'
            # - 'Invoke-WMIMethod' # Prone to FP
            # - 'http://127.0.0.1' # Prone to FP
    condition: selection