{"id":"1f49f2ab-26bc-48b3-96cc-dcffbc93eadf","title":"Potential Suspicious PowerShell Keywords","description":"Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework","author":"Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup)","status":"test","level":"medium","date":"2019-02-11","modified":"2023-04-21","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1","https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1","https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml","source_sha256":"7c244db1a57ffbf421dafc586add2a1db765964d4fd6a08a99a9ce68da35b91e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential Suspicious PowerShell Keywords\nid: 1f49f2ab-26bc-48b3-96cc-dcffbc93eadf\nstatus: test\ndescription: Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework\nreferences:\n    - https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462\n    - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1\n    - https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1\n    - https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7\nauthor: Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup)\ndate: 2019-02-11\nmodified: 2023-04-21\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains:\n            - 'System.Reflection.Assembly.Load($'\n            - '[System.Reflection.Assembly]::Load($'\n            - '[Reflection.Assembly]::Load($'\n            - 'System.Reflection.AssemblyName'\n            - 'Reflection.Emit.AssemblyBuilderAccess'\n            - 'Reflection.Emit.CustomAttributeBuilder'\n            - 'Runtime.InteropServices.UnmanagedType'\n            - 'Runtime.InteropServices.DllImportAttribute'\n            - 'SuspendThread'\n            - 'rundll32'\n            # - 'FromBase64'\n            # - 'Invoke-WMIMethod' # Prone to FP\n            # - 'http://127.0.0.1' # Prone to FP\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/1f49f2ab-26bc-48b3-96cc-dcffbc93eadf.json","kind":"sigma"}