Detectionmediumtest

Suspicious Hyper-V Cmdlets

Adversaries may carry out malicious operations using a virtual instance to avoid detection

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
François HubautCreated Sat Apr 0942d36aa1-3240-4db0-8257-e0118dcdd9cdwindows
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ScriptBlockText|contains:
            - New-VM
            - Set-VMFirmware
            - Start-VM
    condition: selection
False Positives

Legitimate PowerShell scripts

Rule Metadata
Rule ID
42d36aa1-3240-4db0-8257-e0118dcdd9cd
Status
test
Level
medium
Type
Detection
Created
Sat Apr 09
Path
rules/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet.yml
Raw Tags
attack.defense-evasionattack.t1564.006
View on GitHub