PowerShell Called from an Executable Version Mismatch — Sigma Rule

Rule metadata and linked tags

Author: Sean Metcalf (source), Florian Roth (Nextron Systems). Source status: test; severity: high. Source dates: 2017-03-05 / 2023-10-27.

{
  "product": "windows",
  "category": "ps_classic_start"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 41e8514871c4c6ece8a1e4cff43489f0dadb7d067de923eed1498cb37545f6f6

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: PowerShell Called from an Executable Version Mismatch
id: c70e019b-1479-4b65-b0cc-cd0c6093a599
status: test
description: Detects PowerShell called from an executable by the version mismatch method
references:
    - https://adsecurity.org/?p=2921
author: Sean Metcalf (source), Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2023-10-27
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection_engine:
        Data|contains:
            - 'EngineVersion=2.'
            - 'EngineVersion=4.'
            - 'EngineVersion=5.'
    selection_host:
        Data|contains: 'HostVersion=3.'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://adsecurity.org/?p=2921