Detectionhightest

Suspicious PowerShell Invocations - Specific - PowerShell Module

Detects suspicious PowerShell invocation command parameters

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Florian Roth (Nextron Systems), Jonhnathan RibeiroCreated Sun Mar 05Updated Mon Feb 178ff28fdd-e2fa-4dfa-aeda-ef3d61c62090windows

Log Source

WindowsPowerShell Module

ProductWindows← raw: windows

CategoryPowerShell Module← raw: ps_module

Definition

0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection Logic

detection:
    selection_convert_b64:
        ContextInfo|contains|all:
            - '-nop'
            - ' -w '
            - 'hidden'
            - ' -c '
            - '[Convert]::FromBase64String'
    selection_iex:
        ContextInfo|contains|all:
            - ' -w '
            - 'hidden'
            - '-noni'
            - '-nop'
            - ' -c '
            - 'iex'
            - 'New-Object'
    selection_enc:
        ContextInfo|contains|all:
            - ' -w '
            - 'hidden'
            - '-ep'
            - 'bypass'
            - '-Enc'
    selection_reg:
        ContextInfo|contains|all:
            - 'powershell'
            - 'reg'
            - 'add'
        ContextInfo|contains:
            - '\software\microsoft\windows\currentversion\run'
            - '\software\wow6432node\microsoft\windows\currentversion\run'
            - '\software\microsoft\windows\currentversion\policies\explorer\run'
    selection_webclient:
        ContextInfo|contains|all:
            - 'bypass'
            - '-noprofile'
            - '-windowstyle'
            - 'hidden'
            - 'new-object'
            - 'system.net.webclient'
            - '.download'
    selection_iex_webclient:
        ContextInfo|contains|all:
            - 'iex'
            - 'New-Object'
            - 'Net.WebClient'
            - '.Download'
    filter_chocolatey:
        ContextInfo|contains:
            - "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
            - 'Write-ChocolateyWarning'
    condition: 1 of selection_* and not 1 of filter_*