Data Source: PowerShell Logs

PowerShell Keylogging Script

Aug 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects the use of Win32 API Functions that can be used to capture user keystrokes in PowerShell scripts. Attackers use this technique to capture user input, looking for credentials and/or other valuable data.

PowerShell Kerberos Ticket Dump

Aug 20, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: PowerShell Logs ·

Share on:

Detects PowerShell scripts that have the capability of dumping Kerberos tickets from LSA, which potentially indicates an attacker's attempt to acquire credentials for lateral movement.

PowerShell Invoke-NinjaCopy script

Jul 19, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Data Source: PowerShell Logs Resources: Investigation Guide ·

Share on:

Detects PowerShell scripts that contain the default exported functions used on Invoke-NinjaCopy. Attackers can use Invoke-NinjaCopy to read SYSTEM files that are normally locked, such as the NTDS.dit file or registry hives.

PowerShell Script with Encryption/Decryption Capabilities

Jul 19, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Data Source: PowerShell Logs Resources: Investigation Guide ·

Share on:

Identifies the use of Cmdlets and methods related to encryption/decryption of files in PowerShell scripts, which malware and offensive security tools can abuse to encrypt data or decrypt payloads to bypass security solutions.

Potential PowerShell HackTool Script by Function Names

Jul 18, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Data Source: PowerShell Logs ·

Share on:

Detects known PowerShell offensive tooling functions names in PowerShell scripts. Attackers commonly use out-of-the-box offensive tools without modifying the code. This rule aim is to take advantage of that.

PowerShell Suspicious Script with Audio Capture Capabilities

Jul 18, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects PowerShell scripts that can record audio, a common feature in popular post-exploitation tooling.

Exchange Mailbox Export via PowerShell

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Identifies the use of the Exchange PowerShell cmdlet, New-MailBoxExportRequest, to export the contents of a primary mailbox or archive to a .pst file. Adversaries may target user email to collect sensitive information.

Potential Antimalware Scan Interface Bypass via PowerShell

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Data Source: PowerShell Logs Resources: Investigation Guide ·

Share on:

Identifies the execution of PowerShell script with keywords related to different Antimalware Scan Interface (AMSI) bypasses. An adversary may attempt first to disable AMSI before executing further malicious powershell scripts to evade detection.

PowerShell Kerberos Ticket Request

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects PowerShell scripts that have the capability of requesting kerberos tickets, which is a common step in Kerberoasting toolkits to crack service accounts.

PowerShell Script with Token Impersonation Capabilities

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Privilege Escalation Data Source: PowerShell Logs ·

Share on:

Detects scripts that contain PowerShell functions, structures, or Windows API functions related to token impersonation/theft. Attackers may duplicate then impersonate another user's token to escalate privileges and bypass access controls.

PowerShell Suspicious Discovery Related Windows API Functions

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Discovery Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

This rule detects the use of discovery-related Windows API functions in PowerShell Scripts. Attackers can use these functions to perform various situational awareness related activities, like enumerating users, shares, sessions, domain trusts, groups, etc.

PowerShell Suspicious Payload Encoded and Compressed

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Identifies the use of .NET functionality for decompression and base64 decoding combined in PowerShell scripts, which malware and security tools heavily use to deobfuscate payloads and load them directly in memory to bypass defenses.

PowerShell Suspicious Script with Clipboard Retrieval Capabilities

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Collection Data Source: PowerShell Logs Resources: Investigation Guide ·

Share on:

Detects PowerShell scripts that can get the contents of the clipboard, which attackers can abuse to retrieve sensitive information like credentials, messages, etc.

Suspicious .NET Reflection via PowerShell

Jul 14, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects the use of Reflection.Assembly to load PEs and DLLs in memory in PowerShell scripts. Attackers use this method to load executables and DLLs without writing to the disk, bypassing security solutions.

PowerShell Mailbox Collection Script

Jun 28, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Collection Data Source: PowerShell Logs Resources: Investigation Guide ·

Share on:

Detects PowerShell scripts that can be used to collect data from mailboxes. Adversaries may target user email to collect sensitive information.

Potential Invoke-Mimikatz PowerShell Script

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. This rule detects Invoke-Mimikatz PowerShell script and alike.

Potential Process Injection via PowerShell

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Defense Evasion Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects the use of Windows API functions that are commonly abused by malware and security tools to load malicious code or inject it into remote processes.

PowerShell MiniDump Script

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Credential Access Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

This rule detects PowerShell scripts capable of dumping process memory using WindowsErrorReporting or Dbghelp.dll MiniDumpWriteDump. Attackers can use this tooling to dump LSASS and get access to credentials.

PowerShell PSReflect Script

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects the use of PSReflect in PowerShell scripts. Attackers leverage PSReflect as a library that enables PowerShell to access win32 API functions.

PowerShell Share Enumeration Script

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Discovery Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects scripts that contain PowerShell functions, structures, or Windows API functions related to windows share enumeration activities. Attackers, mainly ransomware groups, commonly identify and inspect network shares, looking for critical information for encryption and/or exfiltration.

PowerShell Suspicious Script with Screenshot Capabilities

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Collection Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects PowerShell scripts that can take screenshots, which is a common feature in post-exploitation kits and remote access tools (RATs).

Suspicious Portable Executable Encoded in Powershell Script

Jun 22, 2023 · Domain: Endpoint OS: Windows Use Case: Threat Detection Tactic: Execution Resources: Investigation Guide Data Source: PowerShell Logs ·

Share on:

Detects the presence of a portable executable (PE) in a PowerShell script by looking for its encoded header. Attackers embed PEs into PowerShell scripts to inject them into memory, avoiding defences by not writing to disk.