{"id":"79f4ede3-402e-41c8-bc3e-ebbf5f162581","title":"HackTool - Empire PowerShell Launch Parameters","description":"Detects suspicious powershell command line parameters used in Empire","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-04-20","modified":"2023-02-21","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Other tools that incidentally use the same command line parameters"],"references":["https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64"],"source_path":"rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml","source_sha256":"c07f78a61ca91483c50399e74bab4793f5d5d49e872c413c62fe3e728cc17806","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: HackTool - Empire PowerShell Launch Parameters\nid: 79f4ede3-402e-41c8-bc3e-ebbf5f162581\nstatus: test\ndescription: Detects suspicious powershell command line parameters used in Empire\nreferences:\n    - https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165\n    - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191\n    - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178\n    - https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-04-20\nmodified: 2023-02-21\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        CommandLine|contains:\n            - ' -NoP -sta -NonI -W Hidden -Enc '\n            - ' -noP -sta -w 1 -enc '\n            - ' -NoP -NonI -W Hidden -enc '\n            - ' -noP -sta -w 1 -enc'\n            - ' -enc  SQB'\n            - ' -nop -exec bypass -EncodedCommand '\n    condition: selection\nfalsepositives:\n    - Other tools that incidentally use the same command line parameters\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/79f4ede3-402e-41c8-bc3e-ebbf5f162581.json","kind":"sigma"}