PowerShell Script With File Hostname Resolving Capabilities

calendar Aug 12, 2024 · attack.exfiltration attack.t1020  ·
Share on: linkedin copy

Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.

Sigma rule (View on GitHub)

 1title: PowerShell Script With File Hostname Resolving Capabilities
 2id: fbc5e92f-3044-4e73-a5c6-1c4359b539de
 3status: test
 4description: Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
 5references:
 6    - https://www.fortypoundhead.com/showcontent.asp?artid=24022
 7    - https://labs.withsecure.com/publications/fin7-target-veeam-servers
 8author: Nasreddine Bencherchali (Nextron Systems)
 9date: 2023-05-05
10tags:
11    - attack.exfiltration
12    - attack.t1020
13logsource:
14    product: windows
15    category: ps_script
16    definition: bade5735-5ab0-4aa7-a642-a11be0e40872
17detection:
18    selection:
19        ScriptBlockText|contains|all:
20            - 'Get-content '
21            - 'foreach'
22            - '[System.Net.Dns]::GetHostEntry'
23            - 'Out-File'
24    condition: selection
25falsepositives:
26    - The same functionality can be implemented by admin scripts, correlate with name and creator
27level: medium

References

  • Resolving IP to Hostname with PowerShell

    Getting the hostname from an IP address (or vice versa) is no great magic, and can be done easily with PowerShell, by simply leveraging .Net to do the wor


    Read More

  • FIN7 tradecraft seen in attacks against Veeam backup servers

    WithSecure Intelligence identified attacks which occurred in late March 2023 against internet-facing servers running Veeam Backup & Replication software. Our research indicates that the intrusion set used in these attacks has overlaps with those attributed to the FIN7 activity group. It is likely that initial access & execution was achieved through a recently patched Veeam Backup & Replication vulnerability, CVE-2023-27532.


    Read More

Related rules

to-top