Detectionmediumexperimental
PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script
Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands and invoke cmdlets indirectly by array index. This can be used to evade detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Log Source
WindowsPowerShell Script
ProductWindows← raw: windows
CategoryPowerShell Script← raw: ps_script
Definition
Requirements: Script Block Logging must be enabled
Detection Logic
Detection Logic2 selectors
detection:
selection_module_export_enum:
ScriptBlockText|contains:
- 'Get-Module '
- 'gmo '
ScriptBlockText|contains|all:
- 'ListAvailable'
- 'Microsoft.PowerShell.Utility'
- 'ExportedCommands'
- 'Values'
selection_index_used:
ScriptBlockText|contains: '[*]'
condition: all of selection_*False Positives
Legitimate use of exported commands array indexing in PowerShell scripts (should be rare)
References
MITRE ATT&CK
Techniques
Sub-techniques
Rule Metadata
Rule ID
4ff4ad3e-9fb5-4a70-9962-d6ea58090318
Status
experimental
Level
medium
Type
Detection
Created
Tue Oct 06
Path
rules/windows/powershell/powershell_script/posh_ps_cmdlet_invocation_via_exported_commands_array_index.yml
Raw Tags
attack.executionattack.stealthattack.t1027attack.t1059.001