Execution via CL_Invocation.ps1 (2 Lines)

calendar Apr 21, 2023 · attack.defense_evasion attack.t1216  ·
Share on: linkedin copy

Detects Execution via SyncInvoke in CL_Invocation.ps1 module

Sigma rule (View on GitHub)

 1title: Execution via CL_Invocation.ps1 (2 Lines)
 2id: f588e69b-0750-46bb-8f87-0e9320d57536
 3status: unsupported
 4description: Detects Execution via SyncInvoke in CL_Invocation.ps1 module
 5references:
 6    - https://lolbas-project.github.io/lolbas/Scripts/Cl_invocation/
 7    - https://twitter.com/bohops/status/948061991012327424
 8author: oscd.community, Natalia Shornikova
 9date: 2020/10/14
10modified: 2023/02/24
11tags:
12    - attack.defense_evasion
13    - attack.t1216
14logsource:
15    product: windows
16    category: ps_script
17    definition: 'Requirements: Script Block Logging must be enabled'
18detection:
19    selection:
20        ScriptBlockText|contains:
21            - 'CL_Invocation.ps1'
22            - 'SyncInvoke'
23    condition: selection | count(ScriptBlockText) by Computer > 2
24    # PS > Import-Module c:\Windows\diagnostics\system\Audio\CL_Invocation.ps1
25    # PS > SyncInvoke c:\Evil.exe
26falsepositives:
27    - Unknown
28level: high

References

  • Cl_invocation | LOLBAS

    Import the PowerShell Diagnostic CL_Invocation script and call SyncInvoke to launch an executable. . C:\Windows\diagnostics\system\AERO\CL_Invocation.ps1 \nSyncInvoke [args] Use caseProxy execution...


    Read More

  • Something went wrong, but don’t fret — let’s give it another shot.


    Read More

Related rules

to-top