Detectionhightest

PowerView PowerShell Cmdlets - ScriptBlock

Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Bhabesh RajCreated Tue May 18Updated Wed Nov 22dcd74b95-3f36-4ed9-9598-0490951643aawindows

Log Source

WindowsPowerShell Script

ProductWindows← raw: windows

CategoryPowerShell Script← raw: ps_script

Definition

Requirements: Script Block Logging must be enabled

Detection Logic

detection:
    selection:
        ScriptBlockText|contains:
            - 'Export-PowerViewCSV'
            - 'Find-DomainLocalGroupMember'
            - 'Find-DomainObjectPropertyOutlier'
            - 'Find-DomainProcess'
            - 'Find-DomainShare'
            - 'Find-DomainUserEvent'
            - 'Find-DomainUserLocation'
            - 'Find-ForeignGroup'
            - 'Find-ForeignUser'
            - 'Find-GPOComputerAdmin'
            - 'Find-GPOLocation'
            - 'Find-InterestingDomain' # Covers: Find-InterestingDomainAcl, Find-InterestingDomainShareFile
            - 'Find-InterestingFile'
            - 'Find-LocalAdminAccess'
            - 'Find-ManagedSecurityGroups'
            - 'Get-CachedRDPConnection'
            - 'Get-DFSshare'
            - 'Get-DomainDFSShare'
            - 'Get-DomainDNSRecord'
            - 'Get-DomainDNSZone'
            - 'Get-DomainFileServer'
            - 'Get-DomainGPOComputerLocalGroupMapping'
            - 'Get-DomainGPOLocalGroup'
            - 'Get-DomainGPOUserLocalGroupMapping'
            - 'Get-LastLoggedOn'
            - 'Get-LoggedOnLocal'
            - 'Get-NetFileServer'
            - 'Get-NetForest' # Covers: Get-NetForestCatalog, Get-NetForestDomain, Get-NetForestTrust
            - 'Get-NetGPOGroup'
            - 'Get-NetProcess'
            - 'Get-NetRDPSession'
            - 'Get-RegistryMountedDrive'
            - 'Get-RegLoggedOn'
            - 'Get-WMIRegCachedRDPConnection'
            - 'Get-WMIRegLastLoggedOn'
            - 'Get-WMIRegMountedDrive'
            - 'Get-WMIRegProxy'
            - 'Invoke-ACLScanner'
            - 'Invoke-CheckLocalAdminAccess'
            - 'Invoke-EnumerateLocalAdmin'
            - 'Invoke-EventHunter'
            - 'Invoke-FileFinder'
            - 'Invoke-Kerberoast'
            - 'Invoke-MapDomainTrust'
            - 'Invoke-ProcessHunter'
            - 'Invoke-RevertToSelf'
            - 'Invoke-ShareFinder'
            - 'Invoke-UserHunter'
            - 'Invoke-UserImpersonation'
            - 'Remove-RemoteConnection'
            - 'Request-SPNTicket'
            - 'Resolve-IPAddress'
            # - 'Get-ADObject'  # prone to FPs
            # - 'Get-Domain'  # too many FPs  # Covers Cmdlets like: DomainComputer, DomainController, DomainDFSShare, DomainDNSRecord, DomainGPO, etc.
            # - 'Add-DomainGroupMember'
            # - 'Add-DomainObjectAcl'
            # - 'Add-ObjectAcl'
            # - 'Add-RemoteConnection'
            # - 'Convert-ADName'
            # - 'Convert-NameToSid'
            # - 'ConvertFrom-UACValue'
            # - 'ConvertTo-SID'
            # - 'Get-DNSRecord'
            # - 'Get-DNSZone'
            # - 'Get-DomainComputer'
            # - 'Get-DomainController'
            # - 'Get-DomainGroup'
            # - 'Get-DomainGroupMember'
            # - 'Get-DomainManagedSecurityGroup'
            # - 'Get-DomainObject'
            # - 'Get-DomainObjectAcl'
            # - 'Get-DomainOU'
            # - 'Get-DomainPolicy'
            # - 'Get-DomainSID'
            # - 'Get-DomainSite'
            # - 'Get-DomainSPNTicket'
            # - 'Get-DomainSubnet'
            # - 'Get-DomainUser'
            # - 'Get-DomainUserEvent'
            # - 'Get-Forest' # Covers: Get-ForestDomain, Get-ForestGlobalCatalog, Get-ForestTrust
            # - 'Get-IPAddress'
            # - 'Get-NetComputer' # Covers: Get-NetComputerSiteName
            # - 'Get-NetDomain' # Covers: Get-NetDomainController, Get-NetDomainTrust
            # - 'Get-NetGroup' # Covers: Get-NetGroupMember
            # - 'Get-NetLocalGroup' # Covers: NetLocalGroupMember
            # - 'Get-NetLoggedon'
            # - 'Get-NetOU'
            # - 'Get-NetSession'
            # - 'Get-NetShare'
            # - 'Get-NetSite'
            # - 'Get-NetSubnet'
            # - 'Get-NetUser'
            # - 'Get-ObjectAcl'
            # - 'Get-PathAcl'
            # - 'Get-Proxy'
            # - 'Get-SiteName'
            # - 'Get-UserEvent'
            # - 'Get-WMIProcess'
            # - 'New-DomainGroup'
            # - 'New-DomainUser'
            # - 'Set-ADObject'
            # - 'Set-DomainObject'
            # - 'Set-DomainUserPassword'
            # - 'Test-AdminAccess'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

Resolving title…

powersploit.readthedocs.io

MITRE ATT&CK

Tactics

TA0002 · Execution

Sub-techniques

T1059.001 · PowerShell

Related Rules

SimilarDetectionhigh

HackTool - SharpView Execution

Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems

Detects similar activity. Both rules may fire on overlapping events.

Rule Metadata

Rule ID

dcd74b95-3f36-4ed9-9598-0490951643aa

Status

test

Level

high

Type

Detection

Created

Tue May 18

Modified

Wed Nov 22

Author

Bhabesh Raj

Path

rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml

Raw Tags

attack.executionattack.t1059.001

View on GitHub