{"id":"f772cee9-b7c2-4cb2-8f07-49870adc02e0","title":"Malicious Nishang PowerShell Commandlets","description":"Detects Commandlet names and arguments from the Nishang exploitation framework","author":"Alec Costello","status":"test","level":"high","date":"2019-05-16","modified":"2023-01-16","tags":["attack.execution","attack.t1059.001"],"technique_ids":["T1059.001"],"logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"falsepositives":["Unknown"],"references":["https://github.com/samratashok/nishang"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml","source_sha256":"9b745ee7ff1c5f3b20964ea8d9a3de5e1ab67b85369274820ad3b12252ef9b63","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Malicious Nishang PowerShell Commandlets\nid: f772cee9-b7c2-4cb2-8f07-49870adc02e0\nstatus: test\ndescription: Detects Commandlet names and arguments from the Nishang exploitation framework\nreferences:\n    - https://github.com/samratashok/nishang\nauthor: Alec Costello\ndate: 2019-05-16\nmodified: 2023-01-16\ntags:\n    - attack.execution\n    - attack.t1059.001\nlogsource:\n    product: windows\n    category: ps_script\n    definition: 'Requirements: Script Block Logging must be enabled'\ndetection:\n    selection:\n        ScriptBlockText|contains:\n            - 'Add-ConstrainedDelegationBackdoor'\n            # - 'Add-Persistence' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            # - 'Add-RegBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            # - 'Add-ScrnSaveBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            - 'Copy-VSS'\n            - 'Create-MultipleSessions'\n            - 'DataToEncode'\n            - 'DNS_TXT_Pwnage'\n            - 'Do-Exfiltration-Dns'\n            - 'Download_Execute'\n            - 'Download-Execute-PS'\n            - 'DownloadAndExtractFromRemoteRegistry'\n            - 'DumpCerts'\n            - 'DumpCreds'\n            - 'DumpHashes'\n            - 'Enable-DuplicateToken'\n            - 'Enable-Duplication'\n            - 'Execute-Command-MSSQL'\n            - 'Execute-DNSTXT-Code'\n            - 'Execute-OnTime'\n            - 'ExetoText'\n            - 'exfill'\n            - 'ExfilOption'\n            - 'FakeDC'\n            - 'FireBuster'\n            - 'FireListener'\n            - 'Get-Information ' # Space at the end is required. Otherwise, we get FP with Get-InformationBarrierReportDetails or Get-InformationBarrierReportSummary\n            # - 'Get-PassHashes' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            - 'Get-PassHints'\n            - 'Get-Web-Credentials'\n            - 'Get-WebCredentials'\n            - 'Get-WLAN-Keys'\n            # - 'Gupt-Backdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            - 'HTTP-Backdoor'\n            # - 'Invoke-ADSBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            - 'Invoke-AmsiBypass'\n            - 'Invoke-BruteForce'\n            - 'Invoke-CredentialsPhish'\n            - 'Invoke-Decode'\n            - 'Invoke-Encode'\n            - 'Invoke-Interceptor'\n            - 'Invoke-JSRatRegsvr'\n            - 'Invoke-JSRatRundll'\n            - 'Invoke-MimikatzWDigestDowngrade'\n            - 'Invoke-NetworkRelay'\n            # - 'Invoke-PortScan' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            # - 'Invoke-PoshRatHttp' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            - 'Invoke-PowerShellIcmp'\n            - 'Invoke-PowerShellUdp'\n            - 'Invoke-Prasadhak'\n            - 'Invoke-PSGcat'\n            - 'Invoke-PsGcatAgent'\n            # - 'Invoke-PsUACme' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6\n            - 'Invoke-SessionGopher'\n            - 'Invoke-SSIDExfil'\n            # - Jitter  # Prone to FPs\n            # - 'Keylogger' # Too generic to be linked to Nishang\n            - 'LoggedKeys'\n            - 'Nishang'\n            - 'NotAllNameSpaces' # This is param to \"Set-RemoteWMI\"\n            - 'Out-CHM'\n            - 'OUT-DNSTXT'\n            - 'Out-HTA'\n            - 'Out-RundllCommand'\n            - 'Out-SCF'\n            - 'Out-SCT'\n            - 'Out-Shortcut'\n            - 'Out-WebQuery'\n            - 'Out-Word'\n            - 'Parse_Keys'\n            - 'Password-List'\n            - 'Powerpreter'\n            - 'Remove-Persistence'\n            - 'Remove-PoshRat'\n            - 'Remove-Update'\n            - 'Run-EXEonRemote'\n            - 'Set-DCShadowPermissions'\n            - 'Set-RemotePSRemoting'\n            - 'Set-RemoteWMI'\n            - 'Shellcode32'\n            - 'Shellcode64'\n            - 'StringtoBase64'\n            - 'TexttoExe'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.001","id":"T1059.001","name":"PowerShell","page":"techniques/enterprise/T1059.001/"}],"data_path":"data/detection-rules/f772cee9-b7c2-4cb2-8f07-49870adc02e0.json","kind":"sigma"}