Detection rules › Sigma

Alternate PowerShell Hosts - PowerShell Module

Severity
medium
Author
Roberto Rodriguez @Cyb3rWard0g
Source
upstream

Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell

Event coverage

ProviderEvent IDTitle
PowerShell4103Payload Context: ContextInfo User Data: UserData.

Stages and Predicates

Stage 1: selection

ContextInfo|contains: '*'

Stage 2: not 1 of filter_*

or:
ContextInfo|contains: '= C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell'
ContextInfo|contains: '= C:/Windows/System32/WindowsPowerShell/v1.0/powershell'
ContextInfo|contains: '= C:\WINDOWS\System32\sdiagnhost.exe -Embedding'
ContextInfo|contains: '= C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
ContextInfo|contains: '= C:\Windows\System32\WindowsPowerShell\v1.0\powershell'
ContextInfo|contains: '= \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell'
ContextInfo|contains: '= \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell'
ContextInfo|contains: '= powershell'
ContextInfo|contains: 'C:\Windows\system32\dsac.exe'
ContextInfo|contains: 'C:\Windows\system32\wsmprovhost.exe -Embedding'
ContextInfo|contains: ConfigSyncRun.exe
Payload|contains: 'Failed to update Help for the module'
Payload|contains: Update-Help

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ContextInfomatch
  • *
  • = C:/Windows/SysWOW64/WindowsPowerShell/v1.0/powershell
  • = C:/Windows/System32/WindowsPowerShell/v1.0/powershell
  • = C:\WINDOWS\System32\sdiagnhost.exe -Embedding
  • = C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell
  • = C:\Windows\System32\WindowsPowerShell\v1.0\powershell
  • = \\\?\?\C:Windows\SysWOW64\WindowsPowerShell\v1.0\powershell
  • = \\\?\?\C:Windows\System32\WindowsPowerShell\v1.0\powershell
  • = powershell
  • C:\Windows\system32\dsac.exe
  • C:\Windows\system32\wsmprovhost.exe -Embedding
  • ConfigSyncRun.exe
Payloadmatch
  • Failed to update Help for the module
  • Update-Help