attack.t1059.001

Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell "Get-Variable" technique as seen being used in Colibri Loader

Potential PowerShell Obfuscation Using Alias Cmdlets

Dec 1, 2023 · attack.defense_evasion attack.execution attack.t1027 attack.t1059.001 ·

Share on:

Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts

Potential PowerShell Obfuscation Using Character Join

Dec 1, 2023 · attack.defense_evasion attack.execution attack.t1027 attack.t1059.001 ·

Share on:

Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation

PowerShell Base64 Encoded WMI Classes

Dec 1, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 ·

Share on:

Detects calls to base64 encoded WMI class such as "Win32_Shadowcopy", "Win32_ScheduledJob", etc.

Powershell XML Execute Command

Dec 1, 2023 · attack.execution attack.t1059.001 ·

Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

Suspicious PowerShell Download - PoshModule

Dec 1, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell download command

Usage Of Web Request Commands And Cmdlets - ScriptBlock

Dec 1, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs

Potential APT FIN7 POWERHOLD Execution

Nov 28, 2023 · attack.execution attack.t1059.001 attack.g0046 detection.emerging_threats ·

Share on:

Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs

Potential POWERTRASH Script Execution

Nov 28, 2023 · attack.execution attack.t1059.001 attack.g0046 detection.emerging_threats ·

Share on:

Detects potential execution of the PowerShell script POWERTRASH

Remote Thread Creation Via PowerShell In Potentially Suspicious Target

Nov 10, 2023 · attack.defense_evasion attack.execution attack.t1218.011 attack.t1059.001 ·

Share on:

Detects the creation of a remote thread from a Powershell process in a potentially suspicious target process

Lace Tempest PowerShell Evidence Eraser

Nov 10, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team

Lace Tempest PowerShell Launcher

Nov 10, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team

Execute Code with Pester.bat

Nov 9, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

HackTool - CrackMapExec Execution Patterns

Nov 6, 2023 · attack.execution attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.s0106 ·

Share on:

Detects various execution patterns of the CrackMapExec pentesting framework

Uncommon PowerShell Hosts

Nov 3, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Change PowerShell Policies to an Insecure Level - PowerShell

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects use of Set-ExecutionPolicy to set insecure policies

Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell

Nov 2, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \u2014

Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module

Nov 2, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below

Invoke-Obfuscation Via Use MSHTA - PowerShell Module

Nov 2, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Net WebClient Casing Anomalies

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques

Powershell Inline Execution From A File

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects inline execution of PowerShell code from a file

PowerShell Remote Session Creation

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system

PowerShell Web Download

Nov 2, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects suspicious ways to download files or content using PowerShell

Suspicious Execution of Powershell with Base64

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Commandline to launch powershell with a base64 payload

Suspicious PowerShell Encoded Command Patterns

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains

Suspicious PowerShell Invocations - Generic - PowerShell Module

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell invocation command parameters

Suspicious PowerShell Invocations - Specific

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell invocation command parameters

Suspicious PowerShell Invocations - Specific - PowerShell Module

Nov 2, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell invocation command parameters

BloodHound Collection Files

Oct 28, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects default file names outputted by the BloodHound collection tool SharpHound

Malicious PowerShell Keywords

Oct 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects keywords from well-known PowerShell exploitation frameworks

Nslookup PowerShell Download Cradle

Oct 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.

PowerShell Called from an Executable Version Mismatch

Oct 28, 2023 · attack.defense_evasion attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell called from an executable by the version mismatch method

PowerShell Downgrade Attack - PowerShell

Oct 28, 2023 · attack.defense_evasion attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

Remote PowerShell Session (PS Classic)

Oct 28, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·

Share on:

Detects remote PowerShell sessions

Renamed Powershell Under Powershell Channel

Oct 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects renamed powershell

Suspicious Non PowerShell WSMAN COM Provider

Oct 28, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.003 ·

Share on:

Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.

Suspicious PowerShell Download

Oct 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell download command

Suspicious XOR Encoded PowerShell Command Line - PowerShell

Oct 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell process which includes bxor command, alternative obfuscation method to b64 encoded commands.

CVE-2022-24527 Microsoft Connected Cache LPE

Oct 26, 2023 · attack.privilege_escalation attack.t1059.001 cve.2022.24527 detection.emerging_threats ·

Share on:

Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache

Alternate PowerShell Hosts Pipe

Oct 23, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Bad Opsec Powershell Code Artifacts

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.

ConvertTo-SecureString Cmdlet Usage Via CommandLine

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects usage of the "ConvertTo-SecureString" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity

Exchange PowerShell Snap-Ins Usage

Oct 18, 2023 · attack.execution attack.t1059.001 attack.collection attack.t1114 ·

Share on:

Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27

HackTool - Bloodhound/Sharphound Execution

Oct 18, 2023 · attack.discovery attack.t1087.001 attack.t1087.002 attack.t1482 attack.t1069.001 attack.t1069.002 attack.execution attack.t1059.001 ·

Share on:

Detects command line parameters used by Bloodhound and Sharphound hack tools

HackTool - CrackMapExec PowerShell Obfuscation

Oct 18, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027.005 ·

Share on:

The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.

Invoke-Obfuscation CLIP+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation CLIP+ Launcher - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation COMPRESS OBFUSCATION

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation COMPRESS OBFUSCATION - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation RUNDLL LAUNCHER - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation STDIN+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - Powershell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation STDIN+ Launcher - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation VAR+ Launcher

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR+ Launcher - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation Via Stdin

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - Powershell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Stdin - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Use Clip

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - Powershell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - PowerShell Module

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use Clip - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use MSHTA

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use MSHTA - PowerShell

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use MSHTA - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use MSHTA - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use Rundll32 - Security

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Invoke-Obfuscation Via Use Rundll32 - System

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Malicious Base64 Encoded PowerShell Keywords in Command Lines

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects base64 encoded strings used in hidden malicious PowerShell command lines

Malicious ShellIntel PowerShell Commandlets

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects Commandlet names from ShellIntel exploitation scripts.

Non Interactive PowerShell Process Spawned

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects non-interactive PowerShell activity by looking at the "powershell" process with a non-user GUI process such as "explorer.exe" as a parent.

Potential Baby Shark Malware Activity

Oct 18, 2023 · attack.execution attack.defense_evasion attack.discovery attack.t1012 attack.t1059.003 attack.t1059.001 attack.t1218.005 detection.emerging_threats ·

Share on:

Detects activity that could be related to Baby Shark malware

Potential Data Exfiltration Activity Via CommandLine Tools

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the use of various CLI utilities exfiltrating data via web requests

Potential Encoded PowerShell Patterns In CommandLine

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects specific combinations of encoding methods in PowerShell via the commandline

Potential PowerShell Command Line Obfuscation

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1027 attack.t1059.001 ·

Share on:

Detects the PowerShell command lines with special characters

Potential PowerShell Obfuscation Via Reversed Commands

Oct 18, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers

Potential Powershell ReverseShell Connection

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects usage of the "TcpClient" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang "Invoke-PowerShellTcpOneLine" reverse shell and other.

Potential Suspicious PowerShell Keywords

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell

Oct 18, 2023 · attack.execution attack.t1047 attack.t1059.001 ·

Share on:

Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.

Potentially Suspicious WebDAV LNK Execution

Oct 18, 2023 · attack.execution attack.t1059.001 attack.t1204 ·

Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

PowerShell ADRecon Execution

Oct 18, 2023 · attack.discovery attack.execution attack.t1059.001 ·

Share on:

Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7

PowerShell Base64 Encoded FromBase64String Cmdlet

Oct 18, 2023 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line

PowerShell Base64 Encoded IEX Cmdlet

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects usage of a base64 encoded "IEX" cmdlet in a process command line

PowerShell Base64 Encoded Invoke Keyword

Oct 18, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 ·

Share on:

Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls

PowerShell Core DLL Loaded By Non PowerShell Process

Oct 18, 2023 · attack.t1059.001 attack.execution ·

Share on:

Detects loading of essential DLLs used by PowerShell, but not by the process powershell.exe. Detects behaviour similar to meterpreter's "load powershell" extension.

PowerShell Download Pattern

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects a Powershell process that contains download commands in its command line string

Remote PowerShell Session (Network)

Oct 18, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·

Share on:

Detects remote PowerShell connections by monitoring network outbound connections to ports 5985 or 5986 from a non-network service account.

Suspicious Encoded PowerShell Command Line

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)

Suspicious PowerShell Parent Process

Oct 18, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects a suspicious or uncommon parent processes of PowerShell

Suspicious WSMAN Provider Image Loads

Oct 18, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.003 ·

Share on:

Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.

Suspicious XOR Encoded PowerShell Command

Oct 18, 2023 · attack.defense_evasion attack.execution attack.t1059.001 attack.t1140 attack.t1027 ·

Share on:

Detects presence of a potentially xor encoded powershell command

UNC2452 Process Creation Patterns

Oct 18, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries

Windows Shell/Scripting Processes Spawning Suspicious Programs

Oct 18, 2023 · attack.execution attack.defense_evasion attack.t1059.005 attack.t1059.001 attack.t1218 ·

Share on:

Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.

AWS EC2 Startup Shell Script Change

Oct 17, 2023 · attack.execution attack.t1059.001 attack.t1059.003 attack.t1059.004 ·

Share on:

Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.

Change PowerShell Policies to an Insecure Level

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects use of executionpolicy option to set insecure policies

Execute Code with Pester.bat as Parent

Oct 17, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1216 ·

Share on:

Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)

Execution of Powershell Script in Public Folder

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

This rule detects execution of PowerShell scripts located in the "C:\Users\Public" folder

Invoke-Obfuscation Via Use Rundll32 - PowerShell

Oct 17, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Invoke-Obfuscation Via Use Rundll32 - PowerShell Module

Oct 17, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Powershell MsXml COM Object

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell) Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code

PowerShell Script Run in AppData

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder

PSAsyncShell - Asynchronous TCP Reverse Shell

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell

Suspicious Interactive PowerShell as SYSTEM

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context

Suspicious PowerShell Download - Powershell Script

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell download command

Suspicious PowerShell Download and Execute Pattern

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)

Suspicious PowerShell IEX Execution Patterns

Oct 17, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious ways to run Invoke-Execution using IEX alias

Suspicious Schtasks Execution AppData Folder

Oct 17, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask that executes a file from C:\Users<USER>\AppData\Local

Potential Bumblebee Remote Thread Creation

Oct 15, 2023 · attack.defense_evasion attack.execution attack.t1218.011 attack.t1059.001 detection.emerging_threats ·

Share on:

Detects remote thread injection events based on action seen used by bumblebee

PowerShell Initiated Network Connection

Oct 4, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects a PowerShell process that initiates network connections. Check for suspicious target ports and target systems.

Certificate Exported Via PowerShell

Aug 28, 2023 · attack.credential_access attack.execution attack.t1552.004 attack.t1059.001 ·

Share on:

Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.

HackTool - CrackMapExec Execution

Aug 28, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.credential_access attack.discovery attack.t1047 attack.t1053 attack.t1059.003 attack.t1059.001 attack.t1110 attack.t1201 ·

Share on:

This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.

Potential BlackByte Ransomware Activity

Aug 28, 2023 · detection.emerging_threats attack.execution attack.defense_evasion attack.impact attack.t1485 attack.t1498 attack.t1059.001 attack.t1140 ·

Share on:

Detects command line patterns used by BlackByte ransomware in different operations

Potential DLL File Download Via PowerShell Invoke-WebRequest

Aug 28, 2023 · attack.command_and_control attack.execution attack.t1059.001 attack.t1105 ·

Share on:

Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest cmdlet

Potentially Suspicious PowerShell Child Processes

Aug 28, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects potentially suspicious child processes spawned by PowerShell

Suspicious WebDAV LNK Execution

Aug 5, 2023 · attack.execution attack.t1059.001 attack.t1204 ·

Share on:

Detects possible execution via LNK file accessed on a WebDAV server.

Potential WinAPI Calls Via PowerShell Scripts

Jul 31, 2023 · attack.execution attack.t1059.001 attack.t1106 ·

Share on:

Detects use of WinAPI functions in PowerShell scripts

Scheduled Task Executing Encoded Payload from Registry

Jul 20, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Scheduled Task Executing Payload from Registry

Jul 20, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.

Exploited CVE-2020-10189 Zoho ManageEngine

Jun 20, 2023 · attack.initial_access attack.t1190 attack.execution attack.t1059.001 attack.t1059.003 attack.s0190 cve.2020.10189 detection.emerging_threats ·

Share on:

Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189

Greenbug Espionage Group Indicators

Jun 20, 2023 · attack.g0049 attack.execution attack.t1059.001 attack.command_and_control attack.t1105 attack.defense_evasion attack.t1036.005 detection.emerging_threats ·

Share on:

Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec

MERCURY APT Activity

Jun 20, 2023 · attack.execution attack.t1059.001 attack.g0069 detection.emerging_threats ·

Share on:

Detects suspicious command line patterns seen being used by MERCURY APT

Operation Wocao Activity

Jun 20, 2023 · attack.discovery attack.t1012 attack.defense_evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging_threats ·

Share on:

Detects activity mentioned in Operation Wocao report

Operation Wocao Activity - Security

Jun 20, 2023 · attack.discovery attack.t1012 attack.defense_evasion attack.t1036.004 attack.t1027 attack.execution attack.t1053.005 attack.t1059.001 detection.emerging_threats ·

Share on:

Detects activity mentioned in Operation Wocao report

Potential Emotet Activity

Jun 20, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 detection.emerging_threats ·

Share on:

Detects all Emotet like process executions that are not covered by the more generic rules

Rorschach Ransomware Execution Activity

Jun 20, 2023 · attack.execution attack.t1059.003 attack.t1059.001 attack.defense_evasion detection.emerging_threats ·

Share on:

Detects Rorschach ransomware execution activity

Suspicious PrinterPorts Creation (CVE-2020-1048)

Jun 20, 2023 · attack.persistence attack.execution attack.t1059.001 cve.2020.1048 detection.emerging_threats ·

Share on:

Detects new commands that add new printer port which point to suspicious file

TropicTrooper Campaign November 2018

Jun 20, 2023 · attack.execution attack.t1059.001 detection.emerging_threats ·

Share on:

Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia

Turla Group Commands May 2020

Jun 20, 2023 · attack.g0010 attack.execution attack.t1059.001 attack.t1053.005 attack.t1027 detection.emerging_threats ·

Share on:

Detects commands used by Turla group as reported by ESET in May 2020

UNC2452 PowerShell Pattern

Jun 20, 2023 · attack.execution attack.t1059.001 attack.t1047 detection.emerging_threats ·

Share on:

Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports

Alternate PowerShell Hosts - PowerShell Module

May 15, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

Malicious PowerShell Commandlets - PoshModule

May 15, 2023 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Remote PowerShell Session (PS Module)

May 15, 2023 · attack.execution attack.t1059.001 attack.lateral_movement attack.t1021.006 ·

Share on:

Detects remote PowerShell sessions

Usage Of Web Request Commands And Cmdlets

May 15, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine

Powershell Base64 Encoding (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of powershell.exe with base64 Option. Part of the RedCanary 2023 Threat Detection Report.

Powershell Encoded Command Switch (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Part of the RedCanary 2023 Threat Detection Report.

Powershell Obfuscated Commands (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects powershell command line strings with high numbers of suspicious characters, potentially for obfuscation. Part of the RedCanary 2023 Threat Detection Report.

Suspicious Powershell Commandlets (RedCanary Threat Detection Report)

May 10, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of powershell.exe with suspicious cmdlets or options. Part of the RedCanary 2023 Threat Detection Report.

Invoke-Obfuscation CLIP+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Clip.exe to execute PowerShell

Invoke-Obfuscation COMPRESS OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via COMPRESS OBFUSCATION

Invoke-Obfuscation RUNDLL LAUNCHER

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via RUNDLL LAUNCHER

Invoke-Obfuscation STDIN+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of stdin to execute PowerShell

Invoke-Obfuscation VAR+ Launcher

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated use of Environment Variables to execute PowerShell

Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via VAR++ LAUNCHER

Invoke-Obfuscation Via Stdin

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via Stdin in Scripts

Invoke-Obfuscation Via Use Clip

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Clip.exe in Scripts

Invoke-Obfuscation Via Use MSHTA

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use MSHTA in Scripts

Invoke-Obfuscation Via Use Rundll32

Apr 21, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects Obfuscated Powershell via use Rundll32 in Scripts

Malicious PowerShell Commandlets - ProcessCreation

Apr 21, 2023 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Commandlets - ScriptBlock

Apr 21, 2023 · attack.execution attack.discovery attack.t1482 attack.t1087 attack.t1087.001 attack.t1087.002 attack.t1069.001 attack.t1069.002 attack.t1069 attack.t1059.001 ·

Share on:

Detects Commandlet names from well-known PowerShell exploitation frameworks

Malicious PowerShell Scripts - FileCreation

Apr 21, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the creation of known offensive powershell scripts used for exploitation

Malicious PowerView PowerShell Commandlets

Apr 20, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects Commandlet names from PowerView of PowerSploit exploitation framework.

HTML Help HH.EXE Suspicious Child Process

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious child process of a Microsoft HTML Help (HH.exe)

Suspicious HH.EXE Execution

Apr 12, 2023 · attack.defense_evasion attack.execution attack.initial_access attack.t1047 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.007 attack.t1218 attack.t1218.001 attack.t1218.010 attack.t1218.011 attack.t1566 attack.t1566.001 ·

Share on:

Detects a suspicious execution of a Microsoft HTML Help (HH.exe)

PowerShell Base64 Encoded Reflective Assembly Load

Apr 11, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 attack.t1620 ·

Share on:

Detects base64 encoded .NET reflective loading of Assembly

Silence.EDA Detection

Apr 11, 2023 · attack.execution attack.t1059.001 attack.command_and_control attack.t1071.004 attack.t1572 attack.impact attack.t1529 attack.g0091 attack.s0363 ·

Share on:

Detects Silence EmpireDNSAgent as described in the Group-IP report

Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call

Apr 11, 2023 · attack.execution attack.defense_evasion attack.t1059.001 attack.t1027 ·

Share on:

Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"

HackTool - Default PowerSploit/Empire Scheduled Task Creation

Mar 7, 2023 · attack.execution attack.persistence attack.privilege_escalation attack.s0111 attack.g0022 attack.g0060 car.2013-08-001 attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask via PowerSploit or Empire Default Configuration.

Cmd.EXE Missing Space Characters Execution Anomaly

Mar 7, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe. This could be a sign of obfuscation of a fat finger problem (typo by the developer).

Command Line Execution with Suspicious URL and AppData Strings

Mar 7, 2023 · attack.execution attack.command_and_control attack.t1059.003 attack.t1059.001 attack.t1105 ·

Share on:

Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)

Suspicious File Execution From Internet Hosted WebDav Share

Mar 7, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the execution of the "net use" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files

Detection of PowerShell Execution via Sqlps.exe

Mar 5, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

Invoke-Obfuscation Obfuscated IEX Invocation

Mar 5, 2023 · attack.defense_evasion attack.t1027 attack.execution attack.t1059.001 ·

Share on:

Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block

Remote PowerShell Session Host Process (WinRM)

Mar 5, 2023 · attack.execution attack.t1059.001 attack.t1021.006 ·

Share on:

Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).

SQL Client Tools PowerShell Session Detection

Mar 5, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1127 ·

Share on:

This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio. Script blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.

HackTool - Covenant PowerShell Launcher

Feb 21, 2023 · attack.execution attack.defense_evasion attack.t1059.001 attack.t1564.003 ·

Share on:

Detects suspicious command lines used in Covenant luanchers

HackTool - Empire PowerShell Launch Parameters

Feb 21, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell command line parameters used in Empire

Hidden Powershell in Link File Pattern

Feb 21, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects events that appear when a user click on a link file with a powershell command in it

Potential PowerShell Obfuscation Via WCHAR

Feb 21, 2023 · attack.execution attack.t1059.001 attack.defense_evasion attack.t1027 ·

Share on:

Detects suspicious encoded character syntax often used for defense evasion

PowerShell DownloadFile

Feb 21, 2023 · attack.execution attack.t1059.001 attack.command_and_control attack.t1104 attack.t1105 ·

Share on:

Detects the execution of powershell, a WebClient object creation and the invocation of DownloadFile in a single command line

Suspicious PowerShell Invocation From Script Engines

Feb 21, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious powershell invocations from interpreters or unusual programs

PowerShell Execution Via Named Pipe

Feb 7, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects execution of PowerShell via creation of named pipe starting with PSHost

Remote PowerShell Sessions Network Connections (WinRM)

Feb 7, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986

Base64 Encoded PowerShell Command Detected

Feb 1, 2023 · attack.t1027 attack.defense_evasion attack.t1140 attack.t1059.001 ·

Share on:

Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string

PowerShell Credential Prompt

Feb 1, 2023 · attack.credential_access attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell calling a credential prompt

PowerShell PSAttack

Feb 1, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects the use of PSAttack PowerShell hack tool

PowerShell ShellCode

Feb 1, 2023 · attack.defense_evasion attack.privilege_escalation attack.t1055 attack.execution attack.t1059.001 ·

Share on:

Detects Base64 encoded Shellcode

Suspicious PowerShell Invocations - Generic

Feb 1, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell invocation command parameters

Suspicious PowerShell Parameter Substring

Feb 1, 2023 · attack.execution attack.t1059.001 ·

Share on:

Detects suspicious PowerShell invocation with a parameter substring

Scheduled task executing powershell encoded payload from registry

Jan 8, 2023 · attack.execution attack.persistence attack.t1053.005 attack.t1059.001 ·

Share on:

Detects the creation of a schtask that executes a base64 encoded payload stored in the Windows Registry using PowerShell.

Dnscat Execution

Jan 4, 2023 · attack.exfiltration attack.t1048 attack.execution attack.t1059.001 ·

Share on:

Dnscat exfiltration tool execution

NTFS Alternate Data Stream

Jan 4, 2023 · attack.defense_evasion attack.t1564.004 attack.execution attack.t1059.001 ·

Share on:

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

Potential PowerShell Downgrade Attack

Jan 4, 2023 · attack.defense_evasion attack.execution attack.t1059.001 ·

Share on:

Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0

PowerShell Create Local User

Jan 4, 2023 · attack.execution attack.t1059.001 attack.persistence attack.t1136.001 ·

Share on:

Detects creation of a local user via PowerShell

WMImplant Hack Tool

Jan 4, 2023 · attack.execution attack.t1047 attack.t1059.001 ·

Share on:

Detects parameters used by WMImplant

PowerShell -encodedcommand Switch

Nov 29, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Looks for the execution of powershell.exe with command lines that include variations of the -encodedcommand argument. Inspired by the 2022 Red Canary Threat Detection report.

Base64 Encoding in CMD or Powershell

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Looks for the execution of cmd.exe or powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

PowerShell Base64 Encoding

Nov 9, 2022 · attack.defense_evasion attack.t1140 attack.execution attack.t1059.001 ·

Share on:

Looks for the execution of powershell.exe with command lines that includes the term base64. Inspired by the 2022 Red Canary Threat Detection report.

Suspicious Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 ·

Share on:

Looks for look for cmdlets, methods, and switches that may indicate malicious activity. Inspired by the 2022 Red Canary Threat Detection report.

Suspicious WMI-Related Powershell Cmdlets

Nov 9, 2022 · attack.execution attack.t1059 attack.t1059.001 attack.t1047 ·

Share on:

Detects potential adversaries using powershell WMI-related cmdlets to query the operating system or execute commands, either locally or remotely. Inspired by the 2022 Red Canary Threat Detection report.

Mimikatz through Windows Remote Management

Oct 26, 2022 · attack.credential_access attack.execution attack.t1003.001 attack.t1059.001 attack.lateral_movement attack.t1021.006 attack.s0002 ·

Share on:

Detects usage of mimikatz through WinRM protocol by monitoring access to lsass process by wsmprovhost.exe.

File Was Not Allowed To Run

Oct 25, 2022 · attack.execution attack.t1204.002 attack.t1059.001 attack.t1059.003 attack.t1059.005 attack.t1059.006 attack.t1059.007 ·

Share on:

Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.