detection.wiki

Detection rules › Sigma

PowerView PowerShell Cmdlets - ScriptBlock

Severity
high
Author
Bhabesh Raj
Source
upstream

Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

MITRE ATT&CK coverage

TacticTechniques
ExecutionT1059.001 Command and Scripting Interpreter: PowerShell

Event coverage

ProviderEvent IDTitle
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Stages and Predicates

Stage 1: selection

or:
ScriptBlockText|contains: Export-PowerViewCSV
ScriptBlockText|contains: Find-DomainLocalGroupMember
ScriptBlockText|contains: Find-DomainObjectPropertyOutlier
ScriptBlockText|contains: Find-DomainProcess
ScriptBlockText|contains: Find-DomainShare
ScriptBlockText|contains: Find-DomainUserEvent
ScriptBlockText|contains: Find-DomainUserLocation
ScriptBlockText|contains: Find-ForeignGroup
ScriptBlockText|contains: Find-ForeignUser
ScriptBlockText|contains: Find-GPOComputerAdmin
ScriptBlockText|contains: Find-GPOLocation
ScriptBlockText|contains: Find-InterestingDomain
ScriptBlockText|contains: Find-InterestingFile
ScriptBlockText|contains: Find-LocalAdminAccess
ScriptBlockText|contains: Find-ManagedSecurityGroups
ScriptBlockText|contains: Get-CachedRDPConnection
ScriptBlockText|contains: Get-DFSshare
ScriptBlockText|contains: Get-DomainDFSShare
ScriptBlockText|contains: Get-DomainDNSRecord
ScriptBlockText|contains: Get-DomainDNSZone
ScriptBlockText|contains: Get-DomainFileServer
ScriptBlockText|contains: 'Get-DomainGPOComputerLocalGroupMapping'
ScriptBlockText|contains: Get-DomainGPOLocalGroup
ScriptBlockText|contains: 'Get-DomainGPOUserLocalGroupMapping'
ScriptBlockText|contains: Get-LastLoggedOn
ScriptBlockText|contains: Get-LoggedOnLocal
ScriptBlockText|contains: Get-NetFileServer
ScriptBlockText|contains: Get-NetForest
ScriptBlockText|contains: Get-NetGPOGroup
ScriptBlockText|contains: Get-NetProcess
ScriptBlockText|contains: Get-NetRDPSession
ScriptBlockText|contains: Get-RegLoggedOn
ScriptBlockText|contains: Get-RegistryMountedDrive
ScriptBlockText|contains: Get-WMIRegCachedRDPConnection
ScriptBlockText|contains: Get-WMIRegLastLoggedOn
ScriptBlockText|contains: Get-WMIRegMountedDrive
ScriptBlockText|contains: Get-WMIRegProxy
ScriptBlockText|contains: Invoke-ACLScanner
ScriptBlockText|contains: Invoke-CheckLocalAdminAccess
ScriptBlockText|contains: Invoke-EnumerateLocalAdmin
ScriptBlockText|contains: Invoke-EventHunter
ScriptBlockText|contains: Invoke-FileFinder
ScriptBlockText|contains: Invoke-Kerberoast
ScriptBlockText|contains: Invoke-MapDomainTrust
ScriptBlockText|contains: Invoke-ProcessHunter
ScriptBlockText|contains: Invoke-RevertToSelf
ScriptBlockText|contains: Invoke-ShareFinder
ScriptBlockText|contains: Invoke-UserHunter
ScriptBlockText|contains: Invoke-UserImpersonation
ScriptBlockText|contains: Remove-RemoteConnection
ScriptBlockText|contains: Request-SPNTicket
ScriptBlockText|contains: Resolve-IPAddress

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ScriptBlockTextmatch
  • Export-PowerViewCSV
  • Find-DomainLocalGroupMember
  • Find-DomainObjectPropertyOutlier
  • Find-DomainProcess
  • Find-DomainShare
  • Find-DomainUserEvent
  • Find-DomainUserLocation
  • Find-ForeignGroup
  • Find-ForeignUser
  • Find-GPOComputerAdmin
  • Find-GPOLocation corpus 2 (sigma 2)
  • Find-InterestingDomain
  • Find-InterestingFile
  • Find-LocalAdminAccess
  • Find-ManagedSecurityGroups
  • Get-CachedRDPConnection
  • Get-DFSshare
  • Get-DomainDFSShare
  • Get-DomainDNSRecord
  • Get-DomainDNSZone
  • Get-DomainFileServer
  • Get-DomainGPOComputerLocalGroupMapping
  • Get-DomainGPOLocalGroup
  • Get-DomainGPOUserLocalGroupMapping
  • Get-LastLoggedOn
  • Get-LoggedOnLocal
  • Get-NetFileServer
  • Get-NetForest
  • Get-NetGPOGroup
  • Get-NetProcess
  • Get-NetRDPSession
  • Get-RegLoggedOn
  • Get-RegistryMountedDrive
  • Get-WMIRegCachedRDPConnection
  • Get-WMIRegLastLoggedOn
  • Get-WMIRegMountedDrive
  • Get-WMIRegProxy
  • Invoke-ACLScanner corpus 2 (sigma 2)
  • Invoke-CheckLocalAdminAccess
  • Invoke-EnumerateLocalAdmin
  • Invoke-EventHunter
  • Invoke-FileFinder
  • Invoke-Kerberoast
  • Invoke-MapDomainTrust
  • Invoke-ProcessHunter
  • Invoke-RevertToSelf
  • Invoke-ShareFinder
  • Invoke-UserHunter corpus 2 (sigma 2)
  • Invoke-UserImpersonation
  • Remove-RemoteConnection
  • Request-SPNTicket
  • Resolve-IPAddress

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.