{"id":"2650dd1a-eb2a-412d-ac36-83f06c4f2282","title":"Detected Windows Software Discovery - PowerShell","description":"Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.","author":"Nikita Nazarov, oscd.community","status":"test","level":"medium","date":"2020-10-16","modified":"2022-12-02","tags":["attack.discovery","attack.t1518"],"technique_ids":["T1518"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Legitimate administration activities"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md","https://github.com/harleyQu1nn/AggressorScripts"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml","source_sha256":"959354ead4f36ef0fb3d521c966bbfbf20990469247efaef826e7fb84c81f9fc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_software_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Detected Windows Software Discovery - PowerShell\nid: 2650dd1a-eb2a-412d-ac36-83f06c4f2282\nstatus: test\ndescription: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable.\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1518/T1518.md\n    - https://github.com/harleyQu1nn/AggressorScripts # AVQuery.cna\nauthor: Nikita Nazarov, oscd.community\ndate: 2020-10-16\nmodified: 2022-12-02\ntags:\n    - attack.discovery\n    - attack.t1518\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            # Example: Get-ItemProperty HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | Format-Table -Autosize\n            - 'get-itemProperty'\n            - '\\software\\'\n            - 'select-object'\n            - 'format-table'\n    condition: selection\nfalsepositives:\n    - Legitimate administration activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1518","id":"T1518","name":"Software Discovery","page":"techniques/enterprise/T1518/"}],"data_path":"data/detection-rules/2650dd1a-eb2a-412d-ac36-83f06c4f2282.json","kind":"sigma"}