{"id":"dcd74b95-3f36-4ed9-9598-0490951643aa","title":"PowerView PowerShell Cmdlets - ScriptBlock","description":"Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-05-18","modified":"2023-11-22","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://powersploit.readthedocs.io/en/stable/Recon/README","https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon","https://thedfirreport.com/2020/10/08/ryuks-return","https://adsecurity.org/?p=2277"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml","source_sha256":"130330cd0bed820fd66e6ae2025f8e7111b07fcabc619815cbeda6ac501c4eeb","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerView PowerShell Cmdlets - ScriptBlock\nid: dcd74b95-3f36-4ed9-9598-0490951643aa\nrelated:\n    - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d\n      type: similar\nstatus: test\ndescription: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.\nreferences:\n    - https://powersploit.readthedocs.io/en/stable/Recon/README\n    - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon\n    - https://thedfirreport.com/2020/10/08/ryuks-return\n    - https://adsecurity.org/?p=2277\nauthor: Bhabesh Raj\ndate: 2021-05-18\nmodified: 2023-11-22\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains:\n            - 'Export-PowerViewCSV'\n            - 'Find-DomainLocalGroupMember'\n            - 'Find-DomainObjectPropertyOutlier'\n            - 'Find-DomainProcess'\n            - 'Find-DomainShare'\n            - 'Find-DomainUserEvent'\n            - 'Find-DomainUserLocation'\n            - 'Find-ForeignGroup'\n            - 'Find-ForeignUser'\n            - 'Find-GPOComputerAdmin'\n            - 'Find-GPOLocation'\n            - 'Find-InterestingDomain' # Covers: Find-InterestingDomainAcl, Find-InterestingDomainShareFile\n            - 'Find-InterestingFile'\n            - 'Find-LocalAdminAccess'\n            - 'Find-ManagedSecurityGroups'\n            - 'Get-CachedRDPConnection'\n            - 'Get-DFSshare'\n            - 'Get-DomainDFSShare'\n            - 'Get-DomainDNSRecord'\n            - 'Get-DomainDNSZone'\n            - 'Get-DomainFileServer'\n            - 'Get-DomainGPOComputerLocalGroupMapping'\n            - 'Get-DomainGPOLocalGroup'\n            - 'Get-DomainGPOUserLocalGroupMapping'\n            - 'Get-LastLoggedOn'\n            - 'Get-LoggedOnLocal'\n            - 'Get-NetFileServer'\n            - 'Get-NetForest' # Covers: Get-NetForestCatalog, Get-NetForestDomain, Get-NetForestTrust\n            - 'Get-NetGPOGroup'\n            - 'Get-NetProcess'\n            - 'Get-NetRDPSession'\n            - 'Get-RegistryMountedDrive'\n            - 'Get-RegLoggedOn'\n            - 'Get-WMIRegCachedRDPConnection'\n            - 'Get-WMIRegLastLoggedOn'\n            - 'Get-WMIRegMountedDrive'\n            - 'Get-WMIRegProxy'\n            - 'Invoke-ACLScanner'\n            - 'Invoke-CheckLocalAdminAccess'\n            - 'Invoke-EnumerateLocalAdmin'\n            - 'Invoke-EventHunter'\n            - 'Invoke-FileFinder'\n            - 'Invoke-Kerberoast'\n            - 'Invoke-MapDomainTrust'\n            - 'Invoke-ProcessHunter'\n            - 'Invoke-RevertToSelf'\n            - 'Invoke-ShareFinder'\n            - 'Invoke-UserHunter'\n            - 'Invoke-UserImpersonation'\n            - 'Remove-RemoteConnection'\n            - 'Request-SPNTicket'\n            - 'Resolve-IPAddress'\n            # - 'Get-ADObject'  # prone to FPs\n            # - 'Get-Domain'  # too many FPs  # Covers Cmdlets like: DomainComputer, DomainController, DomainDFSShare, DomainDNSRecord, DomainGPO, etc.\n            # - 'Add-DomainGroupMember'\n            # - 'Add-DomainObjectAcl'\n            # - 'Add-ObjectAcl'\n            # - 'Add-RemoteConnection'\n            # - 'Convert-ADName'\n            # - 'Convert-NameToSid'\n            # - 'ConvertFrom-UACValue'\n            # - 'ConvertTo-SID'\n            # - 'Get-DNSRecord'\n            # - 'Get-DNSZone'\n            # - 'Get-DomainComputer'\n            # - 'Get-DomainController'\n            # - 'Get-DomainGroup'\n            # - 'Get-DomainGroupMember'\n            # - 'Get-DomainManagedSecurityGroup'\n            # - 'Get-DomainObject'\n            # - 'Get-DomainObjectAcl'\n            # - 'Get-DomainOU'\n            # - 'Get-DomainPolicy'\n            # - 'Get-DomainSID'\n            # - 'Get-DomainSite'\n            # - 'Get-DomainSPNTicket'\n            # - 'Get-DomainSubnet'\n            # - 'Get-DomainUser'\n            # - 'Get-DomainUserEvent'\n            # - 'Get-Forest' # Covers: Get-ForestDomain, Get-ForestGlobalCatalog, Get-ForestTrust\n            # - 'Get-IPAddress'\n            # - 'Get-NetComputer' # Covers: Get-NetComputerSiteName\n            # - 'Get-NetDomain' # Covers: Get-NetDomainController, Get-NetDomainTrust\n            # - 'Get-NetGroup' # Covers: Get-NetGroupMember\n            # - 'Get-NetLocalGroup' # Covers: NetLocalGroupMember\n            # - 'Get-NetLoggedon'\n            # - 'Get-NetOU'\n            # - 'Get-NetSession'\n            # - 'Get-NetShare'\n            # - 'Get-NetSite'\n            # - 'Get-NetSubnet'\n            # - 'Get-NetUser'\n            # - 'Get-ObjectAcl'\n            # - 'Get-PathAcl'\n            # - 'Get-Proxy'\n            # - 'Get-SiteName'\n            # - 'Get-UserEvent'\n            # - 'Get-WMIProcess'\n            # - 'New-DomainGroup'\n            # - 'New-DomainUser'\n            # - 'Set-ADObject'\n            # - 'Set-DomainObject'\n            # - 'Set-DomainUserPassword'\n            # - 'Test-AdminAccess'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/dcd74b95-3f36-4ed9-9598-0490951643aa.json","kind":"sigma"}