{"id":"fbc5e92f-3044-4e73-a5c6-1c4359b539de","title":"PowerShell Script With File Hostname Resolving Capabilities","description":"Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-05","modified":"","tags":["attack.exfiltration","attack.t1020"],"technique_ids":["T1020"],"logsource":{"product":"windows","category":"ps_script","definition":"bade5735-5ab0-4aa7-a642-a11be0e40872"},"falsepositives":["The same functionality can be implemented by admin scripts, correlate with name and creator"],"references":["https://www.fortypoundhead.com/showcontent.asp?artid=24022","https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"source_path":"rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml","source_sha256":"d404b8038d1eba5e89f39ab48708a118ed0e188b7f9c76862eb214d4476fcaad","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_resolve_list_of_ip_from_file.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: PowerShell Script With File Hostname Resolving Capabilities\nid: fbc5e92f-3044-4e73-a5c6-1c4359b539de\nstatus: test\ndescription: Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.\nreferences:\n    - https://www.fortypoundhead.com/showcontent.asp?artid=24022\n    - https://labs.withsecure.com/publications/fin7-target-veeam-servers\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-05-05\ntags:\n    - attack.exfiltration\n    - attack.t1020\nlogsource:\n    product: windows\n    category: ps_script\n    definition: bade5735-5ab0-4aa7-a642-a11be0e40872\ndetection:\n    selection:\n        ScriptBlockText|contains|all:\n            - 'Get-content '\n            - 'foreach'\n            - '[System.Net.Dns]::GetHostEntry'\n            - 'Out-File'\n    condition: selection\nfalsepositives:\n    - The same functionality can be implemented by admin scripts, correlate with name and creator\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1020","id":"T1020","name":"Automated Exfiltration","page":"techniques/enterprise/T1020/"}],"data_path":"data/detection-rules/fbc5e92f-3044-4e73-a5c6-1c4359b539de.json","kind":"sigma"}