Malicious PowerShell Scripts - FileCreation
Detects the creation of known offensive powershell scripts used for exploitation
Sigma rule (View on GitHub)
1title: Malicious PowerShell Scripts - FileCreation
2id: f331aa1f-8c53-4fc3-b083-cc159bc971cb
3related:
4 - id: 41025fd7-0466-4650-a813-574aaacbe7f4
5 type: similar
6status: test
7description: Detects the creation of known offensive powershell scripts used for exploitation
8references:
9 - https://github.com/PowerShellMafia/PowerSploit
10 - https://github.com/NetSPI/PowerUpSQL
11 - https://github.com/CsEnox/EventViewer-UACBypass
12 - https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu
13 - https://github.com/nettitude/Invoke-PowerThIEf
14 - https://github.com/S3cur3Th1sSh1t/WinPwn
15 - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries
16 - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1
17 - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1
18 - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1
19 - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1
20 - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/ # Invoke-TotalExec
21 - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/ # Invoke-TotalExec
22 - https://github.com/HarmJ0y/DAMP
23 - https://github.com/samratashok/nishang
24 - https://github.com/DarkCoderSc/PowerRunAsSystem/
25 - https://github.com/besimorhino/powercat
26 - https://github.com/Kevin-Robertson/Powermad
27 - https://github.com/adrecon/ADRecon
28 - https://github.com/adrecon/AzureADRecon
29author: Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein
30date: 2018-04-07
31modified: 2024-01-25
32tags:
33 - attack.execution
34 - attack.t1059.001
35logsource:
36 category: file_event
37 product: windows
38detection:
39 selection_generic:
40 TargetFilename|endswith:
41 # Note: Please ensure alphabetical order when adding new entries
42 - '\Add-ConstrainedDelegationBackdoor.ps1'
43 - '\Add-Exfiltration.ps1'
44 - '\Add-Persistence.ps1'
45 - '\Add-RegBackdoor.ps1'
46 - '\Add-RemoteRegBackdoor.ps1'
47 - '\Add-ScrnSaveBackdoor.ps1'
48 - '\ADRecon.ps1'
49 - '\AzureADRecon.ps1'
50 - '\Check-VM.ps1'
51 - '\ConvertTo-ROT13.ps1'
52 - '\Copy-VSS.ps1'
53 - '\Create-MultipleSessions.ps1'
54 - '\DNS_TXT_Pwnage.ps1'
55 - '\dnscat2.ps1'
56 - '\Do-Exfiltration.ps1'
57 - '\DomainPasswordSpray.ps1'
58 - '\Download_Execute.ps1'
59 - '\Download-Execute-PS.ps1'
60 - '\Enable-DuplicateToken.ps1'
61 - '\Enabled-DuplicateToken.ps1'
62 - '\Execute-Command-MSSQL.ps1'
63 - '\Execute-DNSTXT-Code.ps1'
64 - '\Execute-OnTime.ps1'
65 - '\ExetoText.ps1'
66 - '\Exploit-Jboss.ps1'
67 - '\Find-AVSignature.ps1'
68 - '\Find-Fruit.ps1'
69 - '\Find-GPOLocation.ps1'
70 - '\Find-TrustedDocuments.ps1'
71 - '\FireBuster.ps1'
72 - '\FireListener.ps1'
73 - '\Get-ApplicationHost.ps1'
74 - '\Get-ChromeDump.ps1'
75 - '\Get-ClipboardContents.ps1'
76 - '\Get-ComputerDetail.ps1'
77 - '\Get-FoxDump.ps1'
78 - '\Get-GPPAutologon.ps1'
79 - '\Get-GPPPassword.ps1'
80 - '\Get-IndexedItem.ps1'
81 - '\Get-Keystrokes.ps1'
82 - '\Get-LSASecret.ps1'
83 - '\Get-MicrophoneAudio.ps1'
84 - '\Get-PassHashes.ps1'
85 - '\Get-PassHints.ps1'
86 - '\Get-RegAlwaysInstallElevated.ps1'
87 - '\Get-RegAutoLogon.ps1'
88 - '\Get-RickAstley.ps1'
89 - '\Get-Screenshot.ps1'
90 - '\Get-SecurityPackages.ps1'
91 - '\Get-ServiceFilePermission.ps1'
92 - '\Get-ServicePermission.ps1'
93 - '\Get-ServiceUnquoted.ps1'
94 - '\Get-SiteListPassword.ps1'
95 - '\Get-System.ps1'
96 - '\Get-TimedScreenshot.ps1'
97 - '\Get-UnattendedInstallFile.ps1'
98 - '\Get-Unconstrained.ps1'
99 - '\Get-USBKeystrokes.ps1'
100 - '\Get-VaultCredential.ps1'
101 - '\Get-VulnAutoRun.ps1'
102 - '\Get-VulnSchTask.ps1'
103 - '\Get-WebConfig.ps1'
104 - '\Get-WebCredentials.ps1'
105 - '\Get-WLAN-Keys.ps1'
106 - '\Gupt-Backdoor.ps1'
107 - '\HTTP-Backdoor.ps1'
108 - '\HTTP-Login.ps1'
109 - '\Install-ServiceBinary.ps1'
110 - '\Install-SSP.ps1'
111 - '\Invoke-ACLScanner.ps1'
112 - '\Invoke-ADSBackdoor.ps1'
113 - '\Invoke-AmsiBypass.ps1'
114 - '\Invoke-ARPScan.ps1'
115 - '\Invoke-BackdoorLNK.ps1'
116 - '\Invoke-BadPotato.ps1'
117 - '\Invoke-BetterSafetyKatz.ps1'
118 - '\Invoke-BruteForce.ps1'
119 - '\Invoke-BypassUAC.ps1'
120 - '\Invoke-Carbuncle.ps1'
121 - '\Invoke-Certify.ps1'
122 - '\Invoke-ConPtyShell.ps1'
123 - '\Invoke-CredentialInjection.ps1'
124 - '\Invoke-CredentialsPhish.ps1'
125 - '\Invoke-DAFT.ps1'
126 - '\Invoke-DCSync.ps1'
127 - '\Invoke-Decode.ps1'
128 - '\Invoke-DinvokeKatz.ps1'
129 - '\Invoke-DllInjection.ps1'
130 - '\Invoke-DNSUpdate.ps1'
131 - '\Invoke-DowngradeAccount.ps1'
132 - '\Invoke-EgressCheck.ps1'
133 - '\Invoke-Encode.ps1'
134 - '\Invoke-EventViewer.ps1'
135 - '\Invoke-Eyewitness.ps1'
136 - '\Invoke-FakeLogonScreen.ps1'
137 - '\Invoke-Farmer.ps1'
138 - '\Invoke-Get-RBCD-Threaded.ps1'
139 - '\Invoke-Gopher.ps1'
140 - '\Invoke-Grouper2.ps1'
141 - '\Invoke-Grouper3.ps1'
142 - '\Invoke-HandleKatz.ps1'
143 - '\Invoke-Interceptor.ps1'
144 - '\Invoke-Internalmonologue.ps1'
145 - '\Invoke-Inveigh.ps1'
146 - '\Invoke-InveighRelay.ps1'
147 - '\Invoke-JSRatRegsvr.ps1'
148 - '\Invoke-JSRatRundll.ps1'
149 - '\Invoke-KrbRelay.ps1'
150 - '\Invoke-KrbRelayUp.ps1'
151 - '\Invoke-LdapSignCheck.ps1'
152 - '\Invoke-Lockless.ps1'
153 - '\Invoke-MalSCCM.ps1'
154 - '\Invoke-Mimikatz.ps1'
155 - '\Invoke-MimikatzWDigestDowngrade.ps1'
156 - '\Invoke-Mimikittenz.ps1'
157 - '\Invoke-MITM6.ps1'
158 - '\Invoke-NanoDump.ps1'
159 - '\Invoke-NetRipper.ps1'
160 - '\Invoke-NetworkRelay.ps1'
161 - '\Invoke-NinjaCopy.ps1'
162 - '\Invoke-OxidResolver.ps1'
163 - '\Invoke-P0wnedshell.ps1'
164 - '\Invoke-P0wnedshellx86.ps1'
165 - '\Invoke-Paranoia.ps1'
166 - '\Invoke-PortScan.ps1'
167 - '\Invoke-PoshRatHttp.ps1'
168 - '\Invoke-PoshRatHttps.ps1'
169 - '\Invoke-PostExfil.ps1'
170 - '\Invoke-PowerDump.ps1'
171 - '\Invoke-PowerShellIcmp.ps1'
172 - '\Invoke-PowerShellTCP.ps1'
173 - '\Invoke-PowerShellTcpOneLine.ps1'
174 - '\Invoke-PowerShellTcpOneLineBind.ps1'
175 - '\Invoke-PowerShellUdp.ps1'
176 - '\Invoke-PowerShellUdpOneLine.ps1'
177 - '\Invoke-PowerShellWMI.ps1'
178 - '\Invoke-PowerThIEf.ps1'
179 - '\Invoke-PPLDump.ps1'
180 - '\Invoke-Prasadhak.ps1'
181 - '\Invoke-PsExec.ps1'
182 - '\Invoke-PsGcat.ps1'
183 - '\Invoke-PsGcatAgent.ps1'
184 - '\Invoke-PSInject.ps1'
185 - '\Invoke-PsUaCme.ps1'
186 - '\Invoke-ReflectivePEInjection.ps1'
187 - '\Invoke-ReverseDNSLookup.ps1'
188 - '\Invoke-Rubeus.ps1'
189 - '\Invoke-RunAs.ps1'
190 - '\Invoke-SafetyKatz.ps1'
191 - '\Invoke-SauronEye.ps1'
192 - '\Invoke-SCShell.ps1'
193 - '\Invoke-Seatbelt.ps1'
194 - '\Invoke-ServiceAbuse.ps1'
195 - '\Invoke-SessionGopher.ps1'
196 - '\Invoke-ShellCode.ps1'
197 - '\Invoke-SMBScanner.ps1'
198 - '\Invoke-Snaffler.ps1'
199 - '\Invoke-Spoolsample.ps1'
200 - '\Invoke-SSHCommand.ps1'
201 - '\Invoke-SSIDExfil.ps1'
202 - '\Invoke-StandIn.ps1'
203 - '\Invoke-StickyNotesExtract.ps1'
204 - '\Invoke-Tater.ps1'
205 - '\Invoke-Thunderfox.ps1'
206 - '\Invoke-ThunderStruck.ps1'
207 - '\Invoke-TokenManipulation.ps1'
208 - '\Invoke-Tokenvator.ps1'
209 - '\Invoke-TotalExec.ps1'
210 - '\Invoke-UrbanBishop.ps1'
211 - '\Invoke-UserHunter.ps1'
212 - '\Invoke-VoiceTroll.ps1'
213 - '\Invoke-Whisker.ps1'
214 - '\Invoke-WinEnum.ps1'
215 - '\Invoke-winPEAS.ps1'
216 - '\Invoke-WireTap.ps1'
217 - '\Invoke-WmiCommand.ps1'
218 - '\Invoke-WScriptBypassUAC.ps1'
219 - '\Invoke-Zerologon.ps1'
220 - '\Keylogger.ps1'
221 - '\MailRaider.ps1'
222 - '\New-HoneyHash.ps1'
223 - '\OfficeMemScraper.ps1'
224 - '\Offline_Winpwn.ps1'
225 - '\Out-CHM.ps1'
226 - '\Out-DnsTxt.ps1'
227 - '\Out-Excel.ps1'
228 - '\Out-HTA.ps1'
229 - '\Out-Java.ps1'
230 - '\Out-JS.ps1'
231 - '\Out-Minidump.ps1'
232 - '\Out-RundllCommand.ps1'
233 - '\Out-SCF.ps1'
234 - '\Out-SCT.ps1'
235 - '\Out-Shortcut.ps1'
236 - '\Out-WebQuery.ps1'
237 - '\Out-Word.ps1'
238 - '\Parse_Keys.ps1'
239 - '\Port-Scan.ps1'
240 - '\PowerBreach.ps1'
241 - '\powercat.ps1'
242 - '\Powermad.ps1'
243 - '\PowerRunAsSystem.psm1'
244 - '\PowerSharpPack.ps1'
245 - '\PowerUp.ps1'
246 - '\PowerUpSQL.ps1'
247 - '\PowerView.ps1'
248 - '\PSAsyncShell.ps1'
249 - '\RemoteHashRetrieval.ps1'
250 - '\Remove-Persistence.ps1'
251 - '\Remove-PoshRat.ps1'
252 - '\Remove-Update.ps1'
253 - '\Run-EXEonRemote.ps1'
254 - '\Schtasks-Backdoor.ps1'
255 - '\Set-DCShadowPermissions.ps1'
256 - '\Set-MacAttribute.ps1'
257 - '\Set-RemotePSRemoting.ps1'
258 - '\Set-RemoteWMI.ps1'
259 - '\Set-Wallpaper.ps1'
260 - '\Show-TargetScreen.ps1'
261 - '\Speak.ps1'
262 - '\Start-CaptureServer.ps1'
263 - '\Start-WebcamRecorder.ps1'
264 - '\StringToBase64.ps1'
265 - '\TexttoExe.ps1'
266 - '\VolumeShadowCopyTools.ps1'
267 - '\WinPwn.ps1'
268 - '\WSUSpendu.ps1'
269 selection_invoke_sharp:
270 TargetFilename|contains: 'Invoke-Sharp' # Covers all "Invoke-Sharp" variants
271 TargetFilename|endswith: '.ps1'
272 condition: 1 of selection_*
273falsepositives:
274 - Unknown
275level: high
References
-
-
-
🍊 Orange Tsai EventViewer RCE . Contribute to CsEnox/EventViewer-UACBypass development by creating an account on GitHub.
Read More -
Implement WSUSpendu attack. Contribute to AlsidOfficial/WSUSpendu development by creating an account on GitHub.
Read More -
GitHub - nettitude/Invoke-PowerThIEf: The PowerThIEf, an Internet Explorer Post Exploitation library
The PowerThIEf, an Internet Explorer Post Exploitation library - nettitude/Invoke-PowerThIEf
Read More -
-
-
Invoke-ZeroLogon allows attackers to impersonate any computer, including the domain controller itself, and execute remote procedure calls on their behalf. - BC-SECURITY/Invoke-ZeroLogon
Read More -
-
Random Tools. Contribute to rvrsh3ll/Misc-Powershell-Scripts development by creating an account on GitHub.
Read More -
DomainPasswordSpray is a tool written in PowerShell to perform a password spray attack against users of a domain. By default it will automatically generate the userlist from the domain. BE VERY CAR...
Read More -
Black Basta is ransomware as a service (RaaS) that first emerged in April 2022. However, evidence suggests that it has been in development since February. The Black Basta operator(s) use the double extortion technique, meaning that in addition to encrypting files on the systems of targeted organizations and demanding ransom to make decryption possible, they also maintain a dark web leak site where they threaten to post sensitive information if an organization chooses not to pay ransom.
Read More -
This research was conducted by Ross Inman (@rdi_x64) and Peter Gurney from NCC Group Cyber Incident Response Team. You can find more here Incident Response – NCC Group Summary tl;dr This blog post ...
Read More -
The Discretionary ACL Modification Project: Persistence Through Host-based Security Descriptor Modification - HarmJ0y/DAMP
Read More -
Nishang - Offensive PowerShell for red team, penetration testing and offensive security. - GitHub - samratashok/nishang: Nishang - Offensive PowerShell for red team, penetration testing and offens...
Read More -
PowerRunAsSystem is a PowerShell script, also available as an installable module through the PowerShell Gallery, designed to impersonate the NT AUTHORITY/SYSTEM user and execute commands or launch ...
Read More -
netshell features all in version 2 powershell. Contribute to besimorhino/powercat development by creating an account on GitHub.
Read More -
-
ADRecon is a tool which gathers information about the Active Directory and generates a report which can provide a holistic picture of the current state of the target AD environment. - GitHub - adr...
Read More -
AzureADRecon is a tool which gathers information about the Azure Active Directory and generates a report which can provide a holistic picture of the current state of the target environment. - adrec...
Read More
Related rules
- Malicious PowerShell Scripts - PoshModule
- ChromeLoader Malware Execution
- Obfuscated PowerShell OneLiner Execution
- Raspberry Robin Initial Execution From External Drive
- Raspberry Robin Subsequent Execution of Commands