{"id":"T1059.001","name":"PowerShell","url":"https://attack.mitre.org/techniques/T1059/001","tactics":["execution"],"platforms":["Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0455","stix_id":"x-mitre-detection-strategy--72b209e2-8c65-4217-8532-fabd0cb54ae5","name":"Abuse of PowerShell for Arbitrary Execution","url":"https://attack.mitre.org/detectionstrategies/DET0455","analytics":[{"id":"AN1252","stix_id":"x-mitre-analytic--78864416-9ea3-4285-aab4-ecf31c935253","name":"Analytic 1252","description":"Detects behavioral chains where PowerShell is launched with encoded commands, unusual parent processes, or suspicious modules loaded, potentially followed by network connections or child process spawning. Supports detection of both direct (powershell.exe) and indirect (.NET automation) invocations.","url":"https://attack.mitre.org/detectionstrategies/DET0455#AN1252","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:PowerShell","channel":"EventCode=4103, 4104, 4105, 4106","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:PowerShell","channel":"EventCode=400, 403","data_component":"DC0034","data_component_name":"Process Metadata","log_source_slug":"wineventlog-powershell"},{"name":"WinEventLog:Sysmon","channel":"EventCode=7","data_component":"DC0016","data_component_name":"Module Load","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"CommandLinePattern","description":"Regex pattern for encoded, obfuscated, or hidden PowerShell arguments (e.g., '-enc', '-nop')."},{"field":"ParentProcessName","description":"Filter based on abnormal parents like Excel, WinWord, or mshta spawning PowerShell."},{"field":"TimeWindow","description":"Scope detection to off-hours, lateral movement timeframes, or non-maintenance windows."},{"field":"LoadedModuleList","description":"Tuneable to monitor rare or never-before-seen .NET assemblies tied to PowerShell abuse."},{"field":"ScriptBlockLengthThreshold","description":"Adjustable threshold for length of script blocks logged by Event ID 4104 (useful for filtering noise)."}],"live":true,"detection_strategies":["DET0455"],"techniques":["T1059.001"]}],"live":true,"version":"1.0","techniques":["T1059.001"]}],"sigma_rules":[{"id":"00ca75ab-d5ce-43be-b86c-55ff39c6abfc","title":"Headless Process Launched Via Conhost.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2024-07-23","modified":null,"description":"Detects the launch of a child process via \"conhost.exe\" with the \"--headless\" flag.\nThe \"--headless\" flag hides the windows from the user upon execution.\n","references":["https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","attack.t1059.003","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_conhost_headless_execution.yml","techniques":["T1059.001","T1059.003"],"cves":[]},{"id":"0152550d-3a26-4efd-9f0e-54a0b28ae2f3","title":"Detection of PowerShell Execution via Sqlps.exe","author":"Agro (@agro_sev) oscd.community","status":"test","level":"medium","date":"2020-10-10","modified":"2022-12-09","description":"This rule detects execution of a PowerShell code through the sqlps.exe utility, which is included in the standard set of utilities supplied with the MSSQL Server.\nScript blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.\n","references":["https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15","https://lolbas-project.github.io/lolbas/OtherMSBinaries/Sqlps/","https://twitter.com/bryon_/status/975835709587075072"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_mssql_sqlps_susp_execution.yml","techniques":["T1059.001","T1127"],"cves":[]},{"id":"02030f2f-6199-49ec-b258-ea71b07e03dc","title":"Malicious PowerShell Commandlets - ProcessCreation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-02","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_malicious_cmdlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"02773bed-83bf-469f-b7ff-e676e7d78bab","title":"BloodHound Collection Files","author":"C.J. May","status":"test","level":"high","date":"2022-08-09","modified":"2026-02-19","description":"Detects default file names outputted by the BloodHound collection tool SharpHound","references":["https://academy.hackthebox.com/course/preview/active-directory-bloodhound/bloodhound--data-collection"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.discovery","attack.t1087.001","attack.t1087.002","attack.t1482","attack.t1069.001","attack.t1069.002","attack.execution","attack.t1059.001"],"path":"rules/windows/file/file_event/file_event_win_bloodhound_collection.yml","techniques":["T1087.001","T1087.002","T1482","T1069.001","T1069.002","T1059.001"],"cves":[]},{"id":"03d83090-8cba-44a0-b02f-0b756a050306","title":"Potential WinAPI Calls Via PowerShell Scripts","author":"Nasreddine Bencherchali (Nextron Systems), Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-06","modified":"2026-04-29","description":"Detects usage of WinAPI functions in PowerShell scripts.\nIt may indicate attempts to perform actions such as process injection, token stealing, or other malicious activities that leverage Windows API calls.\nThese techniques are commonly used to evade traditional file-based detections by loading and executing code directly in memory.\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse","https://github.com/PowerShellMafia/PowerSploit/blob/1980f403ee78234eae4d93b50890d02f827a099f/CodeExecution/Invoke-Shellcode.ps1","https://thedfirreport.com/2021/08/29/cobalt-strike-a-defenders-guide/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.t1106","attack.stealth","attack.t1620"],"path":"rules/windows/powershell/powershell_script/posh_ps_win_api_susp_access.yml","techniques":["T1059.001","T1106","T1620"],"cves":[]},{"id":"056c7317-9a09-4bd4-9067-d051312752ea","title":"Powershell Executed From Headless ConHost Process","author":"Matt Anderson (Huntress)","status":"test","level":"medium","date":"2024-07-23","modified":null,"description":"Detects the use of powershell commands from headless ConHost window.\nThe \"--headless\" flag hides the windows from the user upon execution.\n","references":["https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1059.003","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_conhost_headless_powershell.yml","techniques":["T1059.001","T1059.003","T1564.003"],"cves":[]},{"id":"058f4380-962d-40a5-afce-50207d36d7e2","title":"HackTool - CrackMapExec Execution Patterns","author":"Thomas Patzke","status":"stable","level":"high","date":"2020-05-22","modified":"2023-11-06","description":"Detects various execution patterns of the CrackMapExec pentesting framework","references":["https://github.com/byt3bl33d3r/CrackMapExec"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.execution","attack.t1047","attack.t1053","attack.t1059.003","attack.t1059.001","attack.s0106"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution_patterns.yml","techniques":["T1047","T1053","T1059.003","T1059.001"],"cves":[]},{"id":"07ad2ea8-6a55-4ac6-bf3e-91b8e59676eb","title":"Invoke-Obfuscation Via Use MSHTA - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-08","modified":"2023-01-04","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"092bc4b9-3d1d-43b4-a6b4-8c8acd83522f","title":"PowerShell Core DLL Loaded By Non PowerShell Process","author":"Tom Kern, oscd.community, Natalia Shornikova, Tim Shelton, Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2019-11-14","modified":"2026-07-28","description":"Detects loading of essential DLLs used by PowerShell by non-PowerShell process.\nDetects behavior similar to meterpreter's \"load powershell\" extension.\n","references":["https://adsecurity.org/?p=2921","https://github.com/p3nt4/PowerShdll"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.t1059.001","attack.execution"],"path":"rules/windows/image_load/image_load_dll_system_management_automation_susp_load.yml","techniques":["T1059.001"],"cves":[]},{"id":"09576804-7a05-458e-a817-eb718ca91f54","title":"Suspicious PowerShell IEX Execution Patterns","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-03-24","modified":"2022-11-28","description":"Detects suspicious ways to run Invoke-Execution using IEX alias","references":["https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2","https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_iex_patterns.yml","techniques":["T1059.001"],"cves":[]},{"id":"0a74c5a9-1b71-4475-9af2-7829d320d5c2","title":"ChromeLoader Malware Execution","author":"@kostastsale","status":"test","level":"high","date":"2022-01-10","modified":null,"description":"Detects execution of ChromeLoader malware via a registered scheduled task","references":["https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER","https://twitter.com/th3_protoCOL/status/1480621526764322817","https://twitter.com/Kostastsale/status/1480716528421011458","https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001","attack.t1176","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/ChromeLoader/proc_creation_win_malware_chrome_loader_execution.yml","techniques":["T1053.005","T1059.001","T1176"],"cves":[]},{"id":"0adfbc14-0ed1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation VAR+ Launcher - PowerShell","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"0c718a5e-4284-4fb9-b4d9-b9a50b3a1974","title":"Invoke-Obfuscation STDIN+ Launcher - Security","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_stdin_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"0e9e6c63-1350-48c4-9fa1-7ccb235edc68","title":"Rorschach Ransomware Execution Activity","author":"X__Junior (Nextron Systems)","status":"test","level":"critical","date":"2023-04-04","modified":"2023-04-22","description":"Detects Rorschach ransomware execution activity","references":["https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.003","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2023/Malware/Rorschach/proc_creation_win_malware_rorschach_ransomware_activity.yml","techniques":["T1059.003","T1059.001"],"cves":[]},{"id":"0f0450f3-8b47-441e-a31b-15a91dc243e2","title":"Potential DLL File Download Via PowerShell Invoke-WebRequest","author":"Florian Roth (Nextron Systems), Hieu Tran","status":"test","level":"medium","date":"2023-03-13","modified":"2025-07-18","description":"Detects potential DLL files being downloaded using the PowerShell Invoke-WebRequest or Invoke-RestMethod cmdlets.","references":["https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-distribution"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.command-and-control","attack.execution","attack.t1059.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_powershell_download_dll.yml","techniques":["T1059.001","T1105"],"cves":[]},{"id":"0fdc7c7f-c690-4217-9ae3-31f5156eed72","title":"Potential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)","author":"Nisarg Suthar","status":"experimental","level":"high","date":"2025-08-01","modified":null,"description":"Detects suspicious child processes created by CrushFTP. It could be an indication of exploitation of a RCE vulnerability such as CVE-2025-54309.","references":["https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/","https://pwn.guide/free/web/crushftp","https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.initial-access","attack.execution","attack.t1059.001","attack.t1059.003","attack.t1068","attack.t1190","cve.2025-54309","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-54309/proc_creation_win_exploit_cve_2025_54309.yml","techniques":["T1059.001","T1059.003","T1068","T1190"],"cves":["CVE-2025-54309"]},{"id":"1139d2e2-84b1-4226-b445-354492eba8ba","title":"Usage Of Web Request Commands And Cmdlets - ScriptBlock","author":"James Pemberton / @4A616D6573","status":"test","level":"medium","date":"2019-10-24","modified":"2025-10-20","description":"Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via PowerShell scriptblock logs","references":["https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/","https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_web_request_cmd_and_cmdlets.yml","techniques":["T1059.001"],"cves":[]},{"id":"11b52f18-aaec-4d60-9143-5dd8cc4706b9","title":"Invoke-Obfuscation RUNDLL LAUNCHER - System","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_rundll_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"13acf386-b8c6-4fe0-9a6e-c4756b974698","title":"Remote PowerShell Sessions Network Connections (WinRM)","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-09-12","modified":"2022-10-09","description":"Detects basic PowerShell Remoting (WinRM) by monitoring for network inbound connections to ports 5985 OR 5986","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","service":"security"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_remote_powershell_session.yml","techniques":["T1059.001"],"cves":[]},{"id":"1412aa78-a24c-4abd-83df-767dfb2c5bbe","title":"Potentially Suspicious WebDAV LNK Execution","author":"Micah Babinski","status":"test","level":"medium","date":"2023-08-21","modified":null,"description":"Detects possible execution via LNK file accessed on a WebDAV server.","references":["https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html","https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","attack.t1204"],"path":"rules/windows/process_creation/proc_creation_win_webdav_lnk_execution.yml","techniques":["T1059.001","T1204"],"cves":[]},{"id":"14bcba49-a428-42d9-b943-e2ce0f0f7ae6","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - System","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-29","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_var_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"16b37b70-6fcf-4814-a092-c36bd3aafcbd","title":"PowerShell ShellCode","author":"David Ledbetter (shellcode), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2018-11-17","modified":"2024-01-25","description":"Detects Base64 encoded Shellcode","references":["https://twitter.com/cyb3rops/status/1063072865992523776"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1055","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_shellcode_b64.yml","techniques":["T1055","T1059.001"],"cves":[]},{"id":"175997c5-803c-4b08-8bb0-70b099f47595","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - System","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_compress_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"1816994b-42e1-4fb1-afd2-134d88184f71","title":"PowerShell Base64 Encoded WMI Classes","author":"Christian Burkard (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-30","modified":null,"description":"Detects calls to base64 encoded WMI class such as \"Win32_ShadowCopy\", \"Win32_ScheduledJob\", etc.","references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_wmi_classes.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"18988e1b-9087-4f8a-82fe-0414dce49878","title":"Execute Code with Pester.bat as Parent","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-08-20","modified":null,"description":"Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)","references":["https://twitter.com/Oddvarmoe/status/993383596244258816","https://twitter.com/_st0pp3r_/status/1560072680887525378"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pester.yml","techniques":["T1059.001","T1216"],"cves":[]},{"id":"19d65a1c-8540-4140-8062-8eb00db0bba5","title":"WinAPI Library Calls Via PowerShell Scripts","author":"Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-07-21","modified":null,"description":"Detects calls to WinAPI libraries from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.t1106","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_functions_access.yml","techniques":["T1059.001","T1106"],"cves":[]},{"id":"1a0a2ff1-611b-4dac-8216-8a7b47c618a6","title":"Invoke-Obfuscation Via Use Clip - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_clip_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"1ab3c5ed-5baf-417b-bb6b-78ca33f6c3df","title":"AWS EC2 Startup Shell Script Change","author":"faloker","status":"test","level":"high","date":"2020-02-12","modified":"2022-06-07","description":"Detects changes to the EC2 instance startup script. The shell script will be executed as root/SYSTEM every time the specific instances are booted up.","references":["https://github.com/RhinoSecurityLabs/pacu/blob/866376cd711666c775bbfcde0524c817f2c5b181/pacu/modules/ec2__startup_shell_script/main.py#L9"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.execution","attack.t1059.001","attack.t1059.003","attack.t1059.004"],"path":"rules/cloud/aws/cloudtrail/aws_ec2_startup_script_change.yml","techniques":["T1059.001","T1059.003","T1059.004"],"cves":[]},{"id":"1ac8666b-046f-4201-8aba-1951aaec03a3","title":"Command Line Execution with Suspicious URL and AppData Strings","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2019-01-16","modified":"2021-11-27","description":"Detects a suspicious command line execution that includes an URL and AppData string in the command line parameters as used by several droppers (js/vbs > powershell)","references":["https://www.hybrid-analysis.com/sample/3a1f01206684410dbe8f1900bbeaaa543adfcd07368ba646b499fa5274b9edf6?environmentId=100","https://www.hybrid-analysis.com/sample/f16c729aad5c74f19784a24257236a8bbe27f7cdc4a89806031ec7f1bebbd475?environmentId=100"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.command-and-control","attack.t1059.003","attack.t1059.001","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_cmd_http_appdata.yml","techniques":["T1059.003","T1059.001","T1105"],"cves":[]},{"id":"1b9dc62e-6e9e-42a3-8990-94d7a10007f7","title":"Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2022-12-31","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block \\u2014","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"1c2a3268-3881-414a-80af-a5b313b14c0e","title":"Registry Set With Crypto-Classes From The \"Cryptography\" PowerShell Namespace","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-12-01","modified":null,"description":"Detects the setting of a registry inside the \"\\Shell\\Open\\Command\" value with PowerShell classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n","references":["https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0","https://squiblydoo.blog/2023/11/07/october-2023-solarmarker/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1059.001","attack.t1027.010","attack.t1547.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/registry/registry_set/registry_set_powershell_crypto_namespace.yml","techniques":["T1059.001","T1027.010","T1547.001"],"cves":[]},{"id":"1cfac73c-be78-4f9a-9b08-5bde0c3953ab","title":"Operation Wocao Activity","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-10-09","description":"Detects activity mentioned in Operation Wocao report","references":["https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/proc_creation_win_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"1f21ec3f-810d-4b0e-8045-322202e22b4b","title":"Network Connection Initiated By PowerShell Process","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2017-03-13","modified":"2024-03-13","description":"Detects a network connection that was initiated from a PowerShell process.\nOften times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.\nUse this rule as a basis for hunting for anomalies.\n","references":["https://www.youtube.com/watch?v=DLtJTxMWZ2o"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.execution","attack.t1059.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/network_connection/net_connection_win_powershell_network_connection.yml","techniques":["T1059.001"],"cves":[]},{"id":"1f49f2ab-26bc-48b3-96cc-dcffbc93eadf","title":"Potential Suspicious PowerShell Keywords","author":"Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup)","status":"test","level":"medium","date":"2019-02-11","modified":"2023-04-21","description":"Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework","references":["https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462","https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1","https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1","https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml","techniques":["T1059.001"],"cves":[]},{"id":"20e5497e-331c-4cd5-8d36-935f6e2a9a07","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"21f9162c-5f5d-4b01-89a8-b705bd7d10ab","title":"Import PowerShell Modules From Suspicious Directories","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2022-07-07","modified":"2023-01-10","description":"Detects powershell scripts that import modules from suspicious directories","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_import_module_susp_dirs.yml","techniques":["T1059.001"],"cves":[]},{"id":"222720a7-047f-4054-baa5-bab9be757db0","title":"PowerShell MSI Install via WindowsInstaller COM From Remote Location","author":"Meroujan Antonyan (vx3r)","status":"experimental","level":"medium","date":"2025-06-05","modified":null,"description":"Detects the execution of PowerShell commands that attempt to install MSI packages via the\nWindows Installer COM object (`WindowsInstaller.Installer`) hosted remotely.\nThis could be indication of malicious software deployment or lateral movement attempts using Windows Installer functionality.\nAnd the usage of WindowsInstaller COM object rather than msiexec could be an attempt to bypass the detection.\n","references":["https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/","https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/","https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1218","attack.command-and-control","attack.t1105"],"path":"rules/windows/process_creation/proc_creation_win_powershell_comobject_msi_remote.yml","techniques":["T1059.001","T1218","T1105"],"cves":[]},{"id":"243de76f-4725-4f2e-8225-a8a69b15ad61","title":"PowerShell Create Local User","author":"@ROxPinTeddy","status":"test","level":"medium","date":"2020-04-11","modified":"2022-12-25","description":"Detects creation of a local user via PowerShell","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.persistence","attack.t1136.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_create_local_user.yml","techniques":["T1059.001","T1136.001"],"cves":[]},{"id":"25676e10-2121-446e-80a4-71ff8506af47","title":"Exchange PowerShell Snap-Ins Usage","author":"FPT.EagleEye, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2021-03-03","modified":"2023-03-24","description":"Detects adding and using Exchange PowerShell snap-ins to export mailbox data. As seen used by HAFNIUM and APT27","references":["https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/","https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/","https://www.intrinsec.com/apt27-analysis/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","attack.collection","attack.t1114"],"path":"rules/windows/process_creation/proc_creation_win_powershell_snapins_hafnium.yml","techniques":["T1059.001","T1114"],"cves":[]},{"id":"27aec9c9-dbb0-4939-8422-1742242471d0","title":"Invoke-Obfuscation VAR+ Launcher","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-15","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"2b30fa36-3a18-402f-a22d-bf4ce2189f35","title":"Potential Baby Shark Malware Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-02-24","modified":"2023-03-08","description":"Detects activity that could be related to Baby Shark malware","references":["https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.discovery","attack.stealth","attack.t1012","attack.t1059.003","attack.t1059.001","attack.t1218.005","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/BabyShark/proc_creation_win_malware_babyshark.yml","techniques":["T1012","T1059.003","T1059.001","T1218.005"],"cves":[]},{"id":"2c6bea3a-ef58-4f2e-a775-4928f6b7c58a","title":"Raspberry Robin Initial Execution From External Drive","author":"@kostastsale","status":"test","level":"high","date":"2022-05-06","modified":null,"description":"Detects the initial execution of the Raspberry Robin malware from an external drive using \"Cmd.EXE\".","references":["https://redcanary.com/blog/raspberry-robin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_external_drive_exec.yml","techniques":["T1059.001"],"cves":[]},{"id":"2f211361-7dce-442d-b78a-c04039677378","title":"Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2022-12-31","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"30a8cb77-8eb3-4cfb-8e79-ad457c5a4592","title":"Renamed Powershell Under Powershell Channel","author":"Harish Segar, frack113","status":"test","level":"low","date":"2020-06-29","modified":"2025-01-20","description":"Detects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1036.003"],"path":"rules/windows/powershell/powershell_classic/posh_pc_renamed_powershell.yml","techniques":["T1059.001","T1036.003"],"cves":[]},{"id":"30e92f50-bb5a-4884-98b5-d20aa80f3d7a","title":"Hidden Powershell in Link File Pattern","author":"frack113","status":"test","level":"medium","date":"2022-02-06","modified":null,"description":"Detects events that appear when a user click on a link file with a powershell command in it","references":["https://www.x86matthew.com/view_post?id=embed_exe_lnk"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_susp_embed_exe_lnk.yml","techniques":["T1059.001"],"cves":[]},{"id":"3236fcd0-b7e3-4433-b4f8-86ad61a9af2d","title":"PowerShell Download Via Net.WebClient - PowerShell Classic","author":"Florian Roth (Nextron Systems)","status":"test","level":"low","date":"2017-03-05","modified":"2026-04-28","description":"Detects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class.\nThis technique is often abused by attackers to download additional payloads.\n","references":["https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.command-and-control","attack.t1059.001","attack.t1105"],"path":"rules/windows/powershell/powershell_classic/posh_pc_download_via_webclient.yml","techniques":["T1059.001","T1105"],"cves":[]},{"id":"36210e0d-5b19-485d-a087-c096088885f0","title":"Suspicious PowerShell Parameter Substring","author":"Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix)","status":"test","level":"high","date":"2019-01-16","modified":"2022-07-14","description":"Detects suspicious PowerShell invocation with a parameter substring","references":["http://www.danielbohannon.com/blog-1/2017/3/12/powershell-execution-argument-obfuscation-how-it-can-make-detection-easier"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_susp_parameter_variation.yml","techniques":["T1059.001"],"cves":[]},{"id":"3711eee4-a808-4849-8a14-faf733da3612","title":"Greenbug Espionage Group Indicators","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-05-20","modified":"2023-03-09","description":"Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec","references":["https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/greenbug-espionage-telco-south-asia"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.g0049","attack.execution","attack.t1059.001","attack.command-and-control","attack.t1105","attack.t1036.005","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/Greenbug/proc_creation_win_apt_greenbug_may20.yml","techniques":["T1059.001","T1105","T1036.005"],"cves":[]},{"id":"37dc5463-f7e3-4f61-ad76-ba59cd02a651","title":"Lace Tempest PowerShell Launcher","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-11-09","modified":null,"description":"Detects a PowerShell script used by Lace Tempest APT to launch their malware loader by exploiting CVE-2023-47246 as reported by SysAid Team\n","references":["https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_malware_launcher.yml","techniques":["T1059.001"],"cves":[]},{"id":"3a6586ad-127a-4d3b-a677-1e6eacdf8fde","title":"Windows Shell/Scripting Processes Spawning Suspicious Programs","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"high","date":"2018-04-06","modified":"2023-05-23","description":"Detects suspicious child processes of a Windows shell and scripting processes such as wscript, rundll32, powershell, mshta...etc.","references":["https://mgreen27.github.io/posts/2018/04/02/DownloadCradle.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.005","attack.t1059.001","attack.t1218"],"path":"rules/windows/process_creation/proc_creation_win_susp_shell_spawn_susp_program.yml","techniques":["T1059.005","T1059.001","T1218"],"cves":[]},{"id":"3b6ab547-8ec2-4991-b9d2-2b06702a48d7","title":"PowerShell Download Pattern","author":"Florian Roth (Nextron Systems), oscd.community, Jonhnathan Ribeiro","status":"test","level":"medium","date":"2019-01-16","modified":"2025-10-20","description":"Detects a Powershell process that contains download commands in its command line string","references":["https://blog.redteam.pl/2020/06/black-kingdom-ransomware.html","https://lab52.io/blog/winter-vivern-all-summer/","https://hatching.io/blog/powershell-analysis/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_download_patterns.yml","techniques":["T1059.001"],"cves":[]},{"id":"3ceb2083-a27f-449a-be33-14ec1b7cc973","title":"Silence.EDA Detection","author":"Alina Stepchenkova, Group-IB, oscd.community","status":"test","level":"critical","date":"2019-11-01","modified":"2023-04-03","description":"Detects Silence EmpireDNSAgent as described in the Group-IP report","references":["https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.command-and-control","attack.t1071.004","attack.t1572","attack.impact","attack.t1529","attack.g0091","attack.s0363"],"path":"rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml","techniques":["T1059.001","T1071.004","T1572","T1529"],"cves":[]},{"id":"401e5d00-b944-11ea-8f9a-00163ecd60ae","title":"AppLocker Prevented Application or Script from Running","author":"Pushkarev Dmitry","status":"test","level":"medium","date":"2020-06-28","modified":"2025-12-03","description":"Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://nxlog.co/documentation/nxlog-user-guide/applocker.html"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_was_prevented_from_running.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"402e1e1d-ad59-47b6-bf80-1ee44985b3a7","title":"Malicious ShellIntel PowerShell Commandlets","author":"Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems)","status":"test","level":"high","date":"2021-08-09","modified":"2023-01-02","description":"Detects Commandlet names from ShellIntel exploitation scripts.","references":["https://github.com/Shellntel/scripts/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml","techniques":["T1059.001"],"cves":[]},{"id":"403c2cc0-7f6b-4925-9423-bfa573bed7eb","title":"Suspicious PowerShell Download - Powershell Script","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-03-05","modified":"2022-12-02","description":"Detects suspicious PowerShell download command","references":["https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0","https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_download.yml","techniques":["T1059.001"],"cves":[]},{"id":"41025fd7-0466-4650-a813-574aaacbe7f4","title":"Malicious PowerShell Scripts - PoshModule","author":"frack113, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-23","modified":"2025-12-10","description":"Detects the execution of known offensive powershell scripts used for exploitation or reconnaissance","references":["https://github.com/PowerShellMafia/PowerSploit","https://github.com/NetSPI/PowerUpSQL","https://github.com/CsEnox/EventViewer-UACBypass","https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu","https://github.com/nettitude/Invoke-PowerThIEf","https://github.com/S3cur3Th1sSh1t/WinPwn","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_exploit_scripts.yml","techniques":["T1059.001"],"cves":[]},{"id":"42a993dd-bb3e-48c8-b372-4d6684c4106c","title":"HackTool - CrackMapExec Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2023-03-08","description":"This rule detect common flag combinations used by CrackMapExec in order to detect its use even if the binary has been replaced.","references":["https://mpgn.gitbook.io/crackmapexec/smb-protocol/authentication/checking-credentials-local","https://www.mandiant.com/resources/telegram-malware-iranian-espionage","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=mssql-mimikatz","https://www.infosecmatter.com/crackmapexec-module-library/?cmem=smb-pe_inject"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.credential-access","attack.discovery","attack.t1047","attack.t1053","attack.t1059.003","attack.t1059.001","attack.t1110","attack.t1201"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_execution.yml","techniques":["T1047","T1053","T1059.003","T1059.001","T1110","T1201"],"cves":[]},{"id":"43d91656-a9b2-4541-b7e2-6a9bd3a13f4e","title":"DSInternals Suspicious PowerShell Cmdlets","author":"Nasreddine Bencherchali (Nextron Systems), Nounou Mbeiri","status":"test","level":"high","date":"2024-06-26","modified":null,"description":"Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files.\nThe DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.\n","references":["https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.PowerShell/DSInternals.psd1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_dsinternals_cmdlets.yml","techniques":["T1059.001"],"cves":[]},{"id":"44e24481-6202-4c62-9127-5a0ae8e3fe3d","title":"Obfuscated PowerShell OneLiner Execution","author":"@Kostastsale, TheDFIRReport","status":"test","level":"high","date":"2022-05-09","modified":"2025-04-16","description":"Detects the execution of a specific OneLiner to download and execute powershell modules in memory.","references":["https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/","https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.defense-impairment","attack.t1059.001","attack.t1685"],"path":"rules/windows/process_creation/proc_creation_win_powershell_download_cradle_obfuscated.yml","techniques":["T1059.001","T1685"],"cves":[]},{"id":"459628e3-1b00-4e9b-9e5b-7da8961aea35","title":"Suspicious CrushFTP Child Process","author":"Craig Sweeney, Matt Anderson, Jose Oregon, Tim Kasper, Faith Stratton, Samantha Shaw, Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-04-10","modified":null,"description":"Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as\nCVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests.\nThe detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.\n","references":["https://nvd.nist.gov/vuln/detail/CVE-2025-2825","https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update","https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/","https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis","https://projectdiscovery.io/blog/crushftp-authentication-bypass"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.execution","attack.t1059.001","attack.t1059.003","attack.t1190","cve.2025-31161","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-31161/proc_creation_win_crushftp_susp_child_processes.yml","techniques":["T1059.001","T1059.003","T1190"],"cves":["CVE-2025-31161"]},{"id":"487c7524-f892-4054-b263-8a0ace63fc25","title":"Invoke-Obfuscation Via Stdin - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2022-11-29","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_stdin_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"4bf943c6-5146-4273-98dd-e958fd1e3abf","title":"Invoke-Obfuscation Obfuscated IEX Invocation","author":"Daniel Bohannon (@Mandiant/@FireEye), oscd.community","status":"test","level":"high","date":"2019-11-08","modified":"2026-03-16","description":"Detects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the following code block","references":["https://github.com/danielbohannon/Invoke-Obfuscation/blob/f20e7f843edd0a3a7716736e9eddfa423395dd26/Out-ObfuscatedStringCommand.ps1#L873-L888"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_obfuscated_iex_commandline.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"4c54ba8f-73d2-4d40-8890-d9cf1dca3d30","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - Security","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-29","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_var_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"4e19528a-f081-40dd-be09-90c39352bd64","title":"Potential POWERTRASH Script Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-04","modified":null,"description":"Detects potential execution of the PowerShell script POWERTRASH","references":["https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.g0046","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/FIN7/posh_ps_apt_fin7_powertrash_execution.yml","techniques":["T1059.001"],"cves":[]},{"id":"4edf51e1-cb83-4e1a-bc39-800e396068e3","title":"Invoke-Obfuscation CLIP+ Launcher - Security","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-27","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_clip_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"52cad028-0ff0-4854-8f67-d25dfcbc78b4","title":"HTML Help HH.EXE Suspicious Child Process","author":"Maxim Pavlunin, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious child process of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_html_help_susp_child_process.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"557e3bd3-7f21-495d-8d50-7c8bdfb8041c","title":"AppLocker Application Would Have Been Blocked","author":"heyyanu","status":"experimental","level":"medium","date":"2026-03-26","modified":null,"description":"Detects when AppLocker \"Audit only\" enforcement mode reports that an Application, DLL, Script, MSI, or Packaged-App would have been blocked if AppLocker \"Enforce rules\" enforcement mode was enabled.\n","references":["https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker","https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker","https://www.splunk.com/en_us/blog/security/deploy-test-monitor-mastering-microsoft-applocker-part-2.html","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/ee844150(v=ws.11)"],"logsource":{"product":"windows","service":"applocker"},"tags":["attack.execution","attack.t1204.002","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.006","attack.t1059.007"],"path":"rules/windows/builtin/applocker/win_applocker_application_would_have_been_blocked.yml","techniques":["T1204.002","T1059.001","T1059.003","T1059.005","T1059.006","T1059.007"],"cves":[]},{"id":"56c217c3-2de2-479b-990f-5c109ba8458f","title":"HackTool - Default PowerSploit/Empire Scheduled Task Creation","author":"Markus Neis, @Karneades","status":"test","level":"high","date":"2018-03-06","modified":"2023-03-03","description":"Detects the creation of a schtask via PowerSploit or Empire Default Configuration.","references":["https://github.com/0xdeadbeefJERKY/PowerSploit/blob/8690399ef70d2cad10213575ac67e8fa90ddf7c3/Persistence/Persistence.psm1","https://github.com/EmpireProject/Empire/blob/08cbd274bef78243d7a8ed6443b8364acd1fc48b/lib/modules/powershell/persistence/userland/schtasks.py"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.persistence","attack.privilege-escalation","attack.s0111","attack.g0022","attack.g0060","car.2013-08-001","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_powersploit_empire_default_schtasks.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"58cb02d5-78ce-4692-b3e1-dce850aae41a","title":"Alternate PowerShell Hosts Pipe","author":"Roberto Rodriguez @Cyb3rWard0g, Tim Shelton","status":"test","level":"medium","date":"2019-09-12","modified":"2025-10-07","description":"Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe","references":["https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html","https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/pipe_created/pipe_created_powershell_alternate_host_pipe.yml","techniques":["T1059.001"],"cves":[]},{"id":"59e938ff-0d6d-4dc3-b13f-36cc28734d4e","title":"Execute Code with Pester.bat","author":"Julia Fomina, oscd.community","status":"test","level":"medium","date":"2020-10-08","modified":"2023-11-09","description":"Detects code execution via Pester.bat (Pester - Powershell Modulte for testing)","references":["https://twitter.com/Oddvarmoe/status/993383596244258816","https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1216"],"path":"rules/windows/process_creation/proc_creation_win_lolbin_pester_1.yml","techniques":["T1059.001","T1216"],"cves":[]},{"id":"5b40a734-99b6-4b98-a1d0-1cea51a08ab2","title":"Suspicious Interactive PowerShell as SYSTEM","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-12-07","modified":"2022-08-13","description":"Detects the creation of files that indicator an interactive use of PowerShell in the SYSTEM user context","references":["https://jpcertcc.github.io/ToolAnalysisResultSheet/details/PowerSploit_Invoke-Mimikatz.htm"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/file/file_event/file_event_win_susp_system_interactive_powershell.yml","techniques":["T1059.001"],"cves":[]},{"id":"5f9c7f1a-7c21-4c39-b2f3-8d8006e0e51f","title":"PowerShell Web Access Installation - PsScript","author":"Michael Haag","status":"test","level":"high","date":"2024-09-03","modified":null,"description":"Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse","references":["https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication","https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a","https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.persistence","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_powershell_web_access_installation.yml","techniques":["T1059.001"],"cves":[]},{"id":"60167e5c-84b2-4c95-a7ac-86281f27c445","title":"Remote PowerShell Session (PS Classic)","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"low","date":"2019-08-10","modified":"2024-01-03","description":"Detects remote PowerShell sessions","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/powershell/powershell_classic/posh_pc_remote_powershell_session.yml","techniques":["T1059.001","T1021.006"],"cves":[]},{"id":"61d0475c-173f-4844-86f7-f3eebae1c66b","title":"Change PowerShell Policies to an Insecure Level - PowerShell","author":"frack113","status":"test","level":"medium","date":"2021-10-20","modified":"2023-12-14","description":"Detects changing the PowerShell script execution policy to a potentially insecure level using the \"Set-ExecutionPolicy\" cmdlet.","references":["https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4","https://adsecurity.org/?p=2604"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_set_policies_to_unsecure_level.yml","techniques":["T1059.001"],"cves":[]},{"id":"62b7ccc9-23b4-471e-aa15-6da3663c4d59","title":"PowerShell Base64 Encoded Reflective Assembly Load","author":"Christian Burkard (Nextron Systems), pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-03-01","modified":"2023-01-30","description":"Detects base64 encoded .NET reflective loading of Assembly","references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar","https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027","attack.t1620"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load.yml","techniques":["T1059.001","T1027","T1620"],"cves":[]},{"id":"6331d09b-4785-4c13-980f-f96661356249","title":"PowerShell Downgrade Attack - PowerShell","author":"Florian Roth (Nextron Systems), Lee Holmes (idea), Harish Segar (improvements)","status":"test","level":"medium","date":"2017-03-22","modified":"2023-10-27","description":"Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0","references":["http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_classic/posh_pc_downgrade_attack.yml","techniques":["T1059.001"],"cves":[]},{"id":"6385697e-9f1b-40bd-8817-f4a91f40508e","title":"PowerShell Base64 Encoded Invoke Keyword","author":"pH-T (Nextron Systems), Harjot Singh, @cyb3rjy0t","status":"test","level":"high","date":"2022-05-20","modified":"2023-04-06","description":"Detects UTF-8 and UTF-16 Base64 encoded powershell 'Invoke-' calls","references":["https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_invoke.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"63e3365d-4824-42d8-8b82-e56810fefa0c","title":"Invoke-Obfuscation Via Use Clip - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_clip_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"641a4bfb-c017-44f7-800c-2aee0184ce9b","title":"Invoke-Obfuscation Via Use Rundll32 - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_rundll32_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"64e8e417-c19a-475a-8d19-98ea705394cc","title":"Alternate PowerShell Hosts - PowerShell Module","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"medium","date":"2019-08-11","modified":"2025-10-17","description":"Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe","references":["https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml","techniques":["T1059.001"],"cves":[]},{"id":"6676896b-2cce-422d-82af-5a1abe65e241","title":"Potential APT FIN7 Exploitation Activity","author":"Alex Walston (@4ayymm)","status":"test","level":"medium","date":"2024-07-29","modified":null,"description":"Detects potential APT FIN7 exploitation activity as reported by Google.\nIn order to obtain initial access, FIN7 used compromised Remote Desktop Protocol (RDP) credentials to login to a target server and initiate specific Windows process chains.\n","references":["https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","attack.t1059.003","detection.emerging-threats"],"path":"rules-emerging-threats/2024/TA/FIN7/proc_creation_win_apt_fin7_exploitation_indicators.yml","techniques":["T1059.001","T1059.003"],"cves":[]},{"id":"692f0bec-83ba-4d04-af7e-e884a96059b6","title":"Potential WMI Lateral Movement WmiPrvSE Spawned PowerShell","author":"Markus Neis @Karneades","status":"stable","level":"medium","date":"2019-04-03","modified":"2023-03-29","description":"Detects Powershell as a child of the WmiPrvSE process. Which could be a sign of lateral movement via WMI.","references":["https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0735e45e/a2385d6f-34f7-403c-90d3-b1f9d2a90a5e"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1047","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_wmiprvse_spawns_powershell.yml","techniques":["T1047","T1059.001"],"cves":[]},{"id":"6bfb8fa7-b2e7-4f6c-8d9d-824e5d06ea9e","title":"Invoke-Obfuscation VAR+ Launcher - PowerShell Module","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"6c6c6282-7671-4fe9-a0ce-a2dcebdc342b","title":"Powershell XML Execute Command","author":"frack113","status":"test","level":"medium","date":"2022-01-19","modified":"2023-01-19","description":"Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-8---powershell-xml-requests"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_xml_iex.yml","techniques":["T1059.001"],"cves":[]},{"id":"6c76b3d0-afe4-4870-9443-ffe6773c5fef","title":"Potential Exploitation of GoAnywhere MFT Vulnerability","author":"MSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"high","date":"2025-10-07","modified":null,"description":"Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035.\nThis behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.\n","references":["https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1059.001","attack.persistence","attack.t1133","detection.emerging-threats","cve.2025-10035"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-10035/proc_creation_win_exploit_cve_2025_10035.yml","techniques":["T1190","T1059.001","T1133"],"cves":["CVE-2025-10035"]},{"id":"6c96fc76-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-15","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"6f8b3439-a203-45dc-a88b-abf57ea15ccf","title":"HackTool - CrackMapExec PowerShell Obfuscation","author":"Thomas Patzke","status":"test","level":"high","date":"2020-05-22","modified":"2023-02-21","description":"The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.","references":["https://github.com/byt3bl33d3r/CrackMapExec","https://github.com/byt3bl33d3r/CrackMapExec/blob/0a49f75347b625e81ee6aa8c33d3970b5515ea9e/cme/helpers/powershell.py#L242"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027.005"],"path":"rules/windows/process_creation/proc_creation_win_hktl_crackmapexec_powershell_obfuscation.yml","techniques":["T1059.001","T1027.005"],"cves":[]},{"id":"7034cbbb-cc55-4dc2-8dad-36c0b942e8f1","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"71c432c4-e4da-4eab-ba49-e60ea9a81bca","title":"Potential APT FIN7 POWERHOLD Execution","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-05-04","modified":null,"description":"Detects execution of the POWERHOLD script seen used by FIN7 as reported by WithSecureLabs","references":["https://labs.withsecure.com/publications/fin7-target-veeam-servers"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.g0046","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/FIN7/posh_ps_apt_fin7_powerhold.yml","techniques":["T1059.001"],"cves":[]},{"id":"72862bf2-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher - System","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_stdin_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"734f8d9b-42b8-41b2-bcf5-abaf49d5a3c8","title":"Remote PowerShell Session Host Process (WinRM)","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"medium","date":"2019-09-12","modified":"2022-10-09","description":"Detects remote PowerShell sections by monitoring for wsmprovhost (WinRM host process) as a parent or child process (sign of an active PowerShell remote session).","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.lateral-movement","attack.t1059.001","attack.t1021.006"],"path":"rules/windows/process_creation/proc_creation_win_winrm_remote_powershell_session_process.yml","techniques":["T1059.001","T1021.006"],"cves":[]},{"id":"73e67340-0d25-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher - PowerShell","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"74403157-20f5-415d-89a7-c505779585cf","title":"ConvertTo-SecureString Cmdlet Usage Via CommandLine","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","status":"test","level":"medium","date":"2020-10-11","modified":"2023-02-01","description":"Detects usage of the \"ConvertTo-SecureString\" cmdlet via the commandline. Which is fairly uncommon and could indicate potential suspicious activity","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/convertto-securestring?view=powershell-7.3#examples"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cmdline_convertto_securestring.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"74ad4314-482e-4c3e-b237-3f7ed3b9ca8d","title":"Operation Wocao Activity - Security","author":"Florian Roth (Nextron Systems), frack113","status":"test","level":"high","date":"2019-12-20","modified":"2022-11-27","description":"Detects activity mentioned in Operation Wocao report","references":["https://web.archive.org/web/20200226212615/https://www.fox-it.com/en/news/whitepapers/operation-wocao-shining-a-light-on-one-of-chinas-hidden-hacking-groups/","https://web.archive.org/web/20200226212615/https://resources.fox-it.com/rs/170-CAK-271/images/201912_Report_Operation_Wocao.pdf","https://twitter.com/SBousseaden/status/1207671369963646976"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.discovery","attack.stealth","attack.t1012","attack.t1036.004","attack.t1027","attack.execution","attack.t1053.005","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2019/TA/Operation-Wocao/win_security_apt_wocao.yml","techniques":["T1012","T1036.004","T1027","T1053.005","T1059.001"],"cves":[]},{"id":"754ed792-634f-40ae-b3bc-e0448d33f695","title":"Suspicious PowerShell Parent Process","author":"Teymur Kheirkhabarov, Harish Segar","status":"test","level":"high","date":"2020-03-20","modified":"2023-02-04","description":"Detects a suspicious or uncommon parent processes of PowerShell","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=26"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_susp_parent_process.yml","techniques":["T1059.001"],"cves":[]},{"id":"779c8c12-0eb1-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation STDIN+ Launcher - Powershell","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"78aa1347-1517-4454-9982-b338d6df8343","title":"Powershell MsXml COM Object","author":"frack113, MatilJ","status":"test","level":"medium","date":"2022-01-19","modified":"2022-05-19","description":"Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. (Citation: TechNet PowerShell)\nAdversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-7---powershell-msxml-com-object---with-prompt","https://learn.microsoft.com/en-us/previous-versions/windows/desktop/ms766431(v=vs.85)","https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml","techniques":["T1059.001"],"cves":[]},{"id":"79f4ede3-402e-41c8-bc3e-ebbf5f162581","title":"HackTool - Empire PowerShell Launch Parameters","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-04-20","modified":"2023-02-21","description":"Detects suspicious powershell command line parameters used in Empire","references":["https://github.com/EmpireProject/Empire/blob/c2ba61ca8d2031dad0cfc1d5770ba723e8b710db/lib/common/helpers.py#L165","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/deaduser.py#L191","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/lib/modules/powershell/persistence/powerbreach/resolver.py#L178","https://github.com/EmpireProject/Empire/blob/e37fb2eef8ff8f5a0a689f1589f424906fe13055/data/module_source/privesc/Invoke-EventVwrBypass.ps1#L64"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_empire_powershell_launch.yml","techniques":["T1059.001"],"cves":[]},{"id":"7a922f1b-2635-4d6c-91ef-af228b198ad3","title":"Invoke-Obfuscation COMPRESS OBFUSCATION - Security","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_compress_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"7b6a7418-3afc-11f0-aff4-000d3abf478c","title":"Obfuscated PowerShell MSI Install via WindowsInstaller COM","author":"Meroujan Antonyan (vx3r)","status":"experimental","level":"high","date":"2025-05-27","modified":null,"description":"Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).\nThe technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting\nmalformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection\nby hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with\nhidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.\n","references":["https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/","https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/","https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027.010","attack.t1218.007","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_comobject_msi.yml","techniques":["T1027.010","T1218.007","T1059.001"],"cves":[]},{"id":"7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c","title":"Malicious PowerShell Commandlets - PoshModule","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-01-20","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_malicious_commandlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"7d1aaf3d-4304-425c-b7c3-162055e0b3ab","title":"Potential Data Exfiltration Activity Via CommandLine Tools","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-08-02","modified":"2025-10-19","description":"Detects the use of various CLI utilities exfiltrating data via web requests","references":["https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_susp_data_exfiltration_via_cli.yml","techniques":["T1059.001"],"cves":[]},{"id":"7e9c7999-0f9b-4d4a-a6ed-af6d553d4af4","title":"Invoke-Obfuscation Via Use MSHTA - System","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_via_use_mshta_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"7eedcc9d-9fdb-4d94-9c54-474e8affc0c7","title":"Invoke-Obfuscation COMPRESS OBFUSCATION","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-12-29","description":"Detects Obfuscated Powershell via COMPRESS OBFUSCATION","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_compress.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"8028c2c3-e25a-46e3-827f-bbb5abf181d7","title":"WMImplant Hack Tool","author":"NVISO","status":"test","level":"high","date":"2020-03-26","modified":"2022-12-25","description":"Detects parameters used by WMImplant","references":["https://github.com/FortyNorthSecurity/WMImplant"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1047","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_wmimplant.yml","techniques":["T1047","T1059.001"],"cves":[]},{"id":"80b708f3-d034-40e4-a6c8-d23b7a7db3d1","title":"Invoke-Obfuscation Via Stdin - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2022-11-29","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_stdin_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"812837bb-b17f-45e9-8bd0-0ec35d2e3bd6","title":"bXOR Operator Usage In PowerShell Command Line - PowerShell Classic","author":"Teymur Kheirkhabarov, Harish Segar","status":"test","level":"low","date":"2020-06-29","modified":"2024-12-11","description":"Detects powershell execution with that make use of to the bxor (Bitwise XOR).\nAttackers might use as an alternative obfuscation method to Base64 encoded commands.\nInvestigate the CommandLine and process tree to determine if the activity is malicious.\n","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=46","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.t1059.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_bxor_operator_usage.yml","techniques":["T1059.001"],"cves":[]},{"id":"846b866e-2a57-46ee-8e16-85fa92759be7","title":"Exploited CVE-2020-10189 Zoho ManageEngine","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-03-25","modified":"2023-01-21","description":"Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability reported as CVE-2020-10189","references":["https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html","https://vulmon.com/exploitdetails?qidtp=exploitdb&qid=48224"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.initial-access","attack.t1190","attack.execution","attack.t1059.001","attack.t1059.003","attack.s0190","cve.2020-10189","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml","techniques":["T1190","T1059.001","T1059.003"],"cves":["CVE-2020-10189"]},{"id":"846c7a87-8e14-4569-9d49-ecfd4276a01c","title":"DSInternals Suspicious PowerShell Cmdlets - ScriptBlock","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2024-06-26","modified":null,"description":"Detects execution and usage of the DSInternals PowerShell module. Which can be used to perform what might be considered as suspicious activity such as dumping DPAPI backup keys or manipulating NTDS.DIT files.\nThe DSInternals PowerShell Module exposes several internal features of Active Directory and Azure Active Directory. These include FIDO2 and NGC key auditing, offline ntds.dit file manipulation, password auditing, DC recovery from IFM backups and password hash calculation.\n","references":["https://github.com/MichaelGrafnetter/DSInternals/blob/39ee8a69bbdc1cfd12c9afdd7513b4788c4895d4/Src/DSInternals.PowerShell/DSInternals.psd1"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_dsinternals_cmdlets.yml","techniques":["T1059.001"],"cves":[]},{"id":"86588b36-c6d3-465f-9cee-8f9093e07798","title":"Scheduled Task Executing Payload from Registry","author":"X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-07-18","modified":null,"description":"Detects the creation of a schtasks that potentially executes a payload stored in the Windows Registry using PowerShell.","references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_reg_loader.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"86b896ba-ffa1-4fea-83e3-ee28a4c915c7","title":"Invoke-Obfuscation Via Stdin - Powershell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2024-04-05","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"87e3c4e8-a6a8-4ad9-bb4f-46e7ff99a180","title":"Change PowerShell Policies to an Insecure Level","author":"frack113","status":"test","level":"medium","date":"2021-11-01","modified":"2025-10-07","description":"Detects changing the PowerShell script execution policy to a potentially insecure level using the \"-ExecutionPolicy\" flag.","references":["https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4","https://adsecurity.org/?p=2604","https://thedfirreport.com/2021/11/01/from-zero-to-domain-admin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level.yml","techniques":["T1059.001"],"cves":[]},{"id":"88a22f69-62f9-4b8a-aa00-6b0212f2f05a","title":"Invoke-Obfuscation Via Use Rundll32 - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2019-10-08","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"88f680b8-070e-402c-ae11-d2914f2257f1","title":"PowerShell Base64 Encoded IEX Cmdlet","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-08-23","modified":"2023-04-06","description":"Detects usage of a base64 encoded \"IEX\" cmdlet in a process command line","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_iex.yml","techniques":["T1059.001"],"cves":[]},{"id":"89819aa4-bbd6-46bc-88ec-c7f7fe30efa6","title":"Malicious PowerShell Commandlets - ScriptBlock","author":"Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer","status":"test","level":"high","date":"2017-03-05","modified":"2025-12-10","description":"Detects Commandlet names from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/calebstewart/CVE-2021-1675","https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1","https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.discovery","attack.t1482","attack.t1087","attack.t1087.001","attack.t1087.002","attack.t1069.001","attack.t1069.002","attack.t1069","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml","techniques":["T1482","T1087","T1087.001","T1087.002","T1069.001","T1069.002","T1069","T1059.001"],"cves":[]},{"id":"8c521530-5169-495d-a199-0a3a881ad24e","title":"NTFS Alternate Data Stream","author":"Sami Ruohonen","status":"test","level":"high","date":"2018-07-24","modified":"2022-12-25","description":"Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.","references":["https://web.archive.org/web/20220614030603/http://www.powertheshell.com/ntfsstreams/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.004/T1564.004.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1564.004","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml","techniques":["T1564.004","T1059.001"],"cves":[]},{"id":"8c7090c3-e0a0-4944-bd08-08c3a0cecf79","title":"TropicTrooper Campaign November 2018","author":"@41thexplorer, Microsoft Defender ATP","status":"stable","level":"high","date":"2019-11-12","modified":"2020-08-27","description":"Detects TropicTrooper activity, an actor who targeted high-profile organizations in the energy and food and beverage sectors in Asia","references":["https://www.microsoft.com/en-us/security/blog/2018/11/28/windows-defender-atp-device-risk-score-exposes-new-cyberattack-drives-conditional-access-to-protect-networks/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2018/TA/TropicTrooper/proc_creation_win_apt_tropictrooper.yml","techniques":["T1059.001"],"cves":[]},{"id":"8ca7004b-e620-4ecb-870e-86129b5b8e75","title":"Invoke-Obfuscation VAR+ Launcher - System","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_var_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"8d31a8ce-46b5-4dd6-bdc3-680931f1db86","title":"Bad Opsec Powershell Code Artifacts","author":"ok @securonix invrep_de, oscd.community","status":"test","level":"critical","date":"2020-10-09","modified":"2022-12-25","description":"focuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including\nCobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads\nthat often undergo minimal changes by attackers due to bad opsec.\n","references":["https://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/","https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/","https://www.mdeditor.tw/pl/pgRt"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml","techniques":["T1059.001"],"cves":[]},{"id":"8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090","title":"Suspicious PowerShell Invocations - Specific - PowerShell Module","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro","status":"test","level":"high","date":"2017-03-05","modified":"2025-02-17","description":"Detects suspicious PowerShell invocation command parameters","references":["Internal Research","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml","techniques":["T1059.001"],"cves":[]},{"id":"95eadcb2-92e4-4ed1-9031-92547773a6db","title":"Suspicious PowerShell Invocation From Script Engines","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2019-01-16","modified":"2023-01-05","description":"Detects suspicious powershell invocations from interpreters or unusual programs","references":["https://www.securitynewspaper.com/2017/03/20/attackers-leverage-excel-powershell-dns-latest-non-malware-attack/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_script_engine_parent.yml","techniques":["T1059.001"],"cves":[]},{"id":"96b9f619-aa91-478f-bacb-c3e50f8df575","title":"Remote PowerShell Session (PS Module)","author":"Roberto Rodriguez @Cyb3rWard0g, Tim Shelton","status":"test","level":"high","date":"2019-08-10","modified":"2023-01-20","description":"Detects remote PowerShell sessions","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml","techniques":["T1059.001","T1021.006"],"cves":[]},{"id":"96cd126d-f970-49c4-848a-da3a09f55c55","title":"Potential PowerShell Obfuscation Using Alias Cmdlets","author":"frack113","status":"test","level":"low","date":"2023-01-08","modified":"2025-10-22","description":"Detects Set-Alias or New-Alias cmdlet usage. Which can be use as a mean to obfuscate PowerShell scripts","references":["https://github.com/1337Rin/Swag-PSO"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.stealth","attack.t1027","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_set_alias.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"97805087-93ab-4203-b5cb-287cda6aecaa","title":"FakeUpdates/SocGholish Activity","author":"@kostastsale","status":"test","level":"high","date":"2022-06-16","modified":"2024-08-23","description":"Detects initial execution of FakeUpdates/SocGholish malware via wscript that later executes commands via cmd or powershell.","references":["https://twitter.com/th3_protoCOL/status/1536788652889497600","https://twitter.com/1ZRR4H/status/1537501582727778304"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/SocGholish/proc_creation_win_malware_socgholish_fakeupdates_activity.yml","techniques":["T1059.001"],"cves":[]},{"id":"994cac2b-92c2-44bf-8853-14f6ca39fbda","title":"Potential Bumblebee Remote Thread Creation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-09-27","modified":null,"description":"Detects remote thread injection events based on action seen used by bumblebee","references":["https://thedfirreport.com/2022/09/26/bumblebee-round-two/"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.execution","attack.stealth","attack.t1218.011","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/Bumblebee/create_remote_thread_win_malware_bumblebee.yml","techniques":["T1218.011","T1059.001"],"cves":[]},{"id":"999bff6d-dc15-44c9-9f5c-e1051bfc86e1","title":"Nslookup PowerShell Download Cradle","author":"Sai Prashanth Pulisetti @pulisettis, Aishwarya Singam","status":"test","level":"medium","date":"2022-12-10","modified":"2025-02-25","description":"Detects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.","references":["https://twitter.com/Alh4zr3d/status/1566489367232651264"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_classic/posh_pc_abuse_nslookup_with_dns_records.yml","techniques":["T1059.001"],"cves":[]},{"id":"999e8307-a775-4d5f-addc-4855632335be","title":"Potential BlackByte Ransomware Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-25","modified":"2023-02-08","description":"Detects command line patterns used by BlackByte ransomware in different operations","references":["https://redcanary.com/blog/blackbyte-ransomware/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.impact","attack.stealth","attack.t1485","attack.t1498","attack.t1059.001","attack.t1140","detection.emerging-threats"],"path":"rules-emerging-threats/2021/Malware/BlackByte/proc_creation_win_malware_blackbyte_ransomware.yml","techniques":["T1485","T1498","T1059.001","T1140"],"cves":[]},{"id":"99b97608-3e21-4bfe-8217-2a127c396a0e","title":"Remote Thread Creation Via PowerShell In Uncommon Target","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2018-06-25","modified":"2023-11-10","description":"Detects the creation of a remote thread from a Powershell process in an uncommon target process","references":["https://www.fireeye.com/blog/threat-research/2018/06/bring-your-own-land-novel-red-teaming-technique.html"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.execution","attack.stealth","attack.t1218.011","attack.t1059.001"],"path":"rules/windows/create_remote_thread/create_remote_thread_win_powershell_susp_targets.yml","techniques":["T1218.011","T1059.001"],"cves":[]},{"id":"9ac8b09b-45de-4a07-9da1-0de8c09304a3","title":"Invoke-Obfuscation STDIN+ Launcher - PowerShell Module","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-05","description":"Detects Obfuscated use of stdin to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"9b8d9203-4e0f-4cd9-bb06-4cc4ea6d0e9a","title":"Invoke-Obfuscation Via Use MSHTA - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_mshta_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"9be34ad0-b6a7-4fbd-91cf-fc7ec1047f5f","title":"UNC2452 Process Creation Patterns","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2021-01-22","modified":"2024-09-12","description":"Detects a specific process creation patterns as seen used by UNC2452 and provided by Microsoft as Microsoft Defender ATP queries","references":["https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_cmds.yml","techniques":["T1059.001"],"cves":[]},{"id":"9c0295ce-d60d-40bd-bd74-84673b7592b1","title":"Suspicious Encoded And Obfuscated Reflection Assembly Load Function Call","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-03-01","modified":"2023-04-06","description":"Detects suspicious base64 encoded and obfuscated \"LOAD\" keyword used in .NET \"reflection.assembly\"","references":["https://github.com/Neo23x0/Raccine/blob/20a569fa21625086433dcce8bb2765d0ea08dcb6/yara/mal_revil.yar","https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/","https://learn.microsoft.com/en-us/dotnet/api/system.appdomain.load?view=net-7.0"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_reflection_assembly_load_obfusc.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"9c14c9fa-1a63-4a64-8e57-d19280559490","title":"Invoke-Obfuscation Via Stdin","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2026-03-16","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"9e2e51c5-c699-4794-ba5a-29f5da40ac0c","title":"Turla Group Commands May 2020","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2020-05-26","modified":"2025-10-19","description":"Detects commands used by Turla group as reported by ESET in May 2020","references":["https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.stealth","attack.g0010","attack.execution","attack.t1059.001","attack.t1053.005","attack.t1027","detection.emerging-threats"],"path":"rules-emerging-threats/2014/TA/Turla/proc_creation_win_apt_turla_comrat_may20.yml","techniques":["T1059.001","T1053.005","T1027"],"cves":[]},{"id":"9e716b33-63b2-46da-86a4-bd3c3b9b5dfb","title":"Certificate Exported Via PowerShell","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-05-18","modified":null,"description":"Detects calls to cmdlets that are used to export certificates from the local certificate store. Threat actors were seen abusing this to steal private keys from compromised machines.","references":["https://us-cert.cisa.gov/ncas/analysis-reports/ar21-112a","https://learn.microsoft.com/en-us/powershell/module/pki/export-pfxcertificate?view=windowsserver2022-ps","https://www.splunk.com/en_us/blog/security/breaking-the-chain-defending-against-certificate-services-abuse.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.credential-access","attack.execution","attack.t1552.004","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_export_certificate.yml","techniques":["T1552.004","T1059.001"],"cves":[]},{"id":"9f22ccd5-a435-453b-af96-bf99cbb594d4","title":"WinAPI Function Calls Via PowerShell Scripts","author":"Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-07-21","modified":null,"description":"Detects calls to WinAPI functions from PowerShell scripts. Attackers can often leverage these APIs to avoid detection based on typical PowerShell function calls. Use this rule as a basis to hunt for interesting scripts.","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","attack.t1106","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_script/posh_ps_win_api_library_access.yml","techniques":["T1059.001","T1106"],"cves":[]},{"id":"9fc51a3c-81b3-4fa7-b35f-7c02cf10fd2d","title":"Usage Of Web Request Commands And Cmdlets","author":"James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger","status":"test","level":"medium","date":"2019-10-24","modified":"2025-10-20","description":"Detects the use of various web request commands with commandline tools and Windows PowerShell cmdlets (including aliases) via CommandLine","references":["https://4sysops.com/archives/use-powershell-to-download-a-file-with-http-https-and-ftp/","https://blog.jourdant.me/post/3-ways-to-download-files-with-powershell","https://learn.microsoft.com/en-us/powershell/module/bitstransfer/add-bitsfile?view=windowsserver2019-ps"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_susp_web_request_cmd_and_cmdlets.yml","techniques":["T1059.001"],"cves":[]},{"id":"a0edd39f-a0c6-4c17-8141-261f958e8d8f","title":"PowerShell Remote Session Creation","author":"frack113","status":"test","level":"medium","date":"2022-01-06","modified":"2023-01-02","description":"Adversaries may abuse PowerShell commands and scripts for execution.\nPowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-10---powershell-invoke-downloadcradle","https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/new-pssession?view=powershell-7.4"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_remote_session_creation.yml","techniques":["T1059.001"],"cves":[]},{"id":"a136cde0-61ad-4a61-9b82-8dc490e60dd2","title":"Invoke-Obfuscation CLIP+ Launcher - PowerShell Module","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"a16980c2-0c56-4de0-9a79-17971979efdd","title":"Cmd.EXE Missing Space Characters Execution Anomaly","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-23","modified":"2026-05-13","description":"Detects Windows command lines that miss a space before or after the /c flag when running a command using the cmd.exe.\nThis could be a sign of obfuscation of a fat finger problem (typo by the developer).\n","references":["https://twitter.com/cyb3rops/status/1562072617552678912","https://ss64.com/nt/cmd.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_cmd_no_space_execution.yml","techniques":["T1059.001"],"cves":[]},{"id":"a23791fe-8846-485a-b16b-ca691e1b03d4","title":"Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"a5a30a6e-75ca-4233-8b8c-42e0f2037d3b","title":"Invoke-Obfuscation Via Use Rundll32 - PowerShell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2019-10-08","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"a62298a3-1fe0-422f-9a68-ffbcbc5a123d","title":"MERCURY APT Activity","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-08-26","modified":"2023-03-10","description":"Detects suspicious command line patterns seen being used by MERCURY APT","references":["https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","attack.g0069","detection.emerging-threats"],"path":"rules-emerging-threats/2022/TA/MERCURY/proc_creation_win_apt_mercury.yml","techniques":["T1059.001"],"cves":[]},{"id":"a6a39bdb-935c-4f0a-ab77-35f4bbf44d33","title":"Potentially Suspicious Powershell Script Execution From Temp Folder","author":"Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton","status":"test","level":"medium","date":"2021-07-14","modified":"2026-02-17","description":"Detects a potentially suspicious powershell script executions from temporary folder","references":["https://www.microsoft.com/security/blog/2021/07/13/microsoft-discovers-threat-actor-targeting-solarwinds-serv-u-software-with-0-day-exploit/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_script_exec_from_temp_folder.yml","techniques":["T1059.001"],"cves":[]},{"id":"a746c9b8-a2fb-4ee5-a428-92bee9e99060","title":"SQL Client Tools PowerShell Session Detection","author":"Agro (@agro_sev) oscd.communitly","status":"test","level":"medium","date":"2020-10-13","modified":"2022-02-25","description":"This rule detects execution of a PowerShell code through the sqltoolsps.exe utility, which is included in the standard set of utilities supplied with the Microsoft SQL Server Management studio.\nScript blocks are not logged in this case, so this utility helps to bypass protection mechanisms based on the analysis of these logs.\n","references":["https://github.com/LOLBAS-Project/LOLBAS/blob/8283d8d91552213ded165fd36deb6cb9534cb443/yml/OtherMSBinaries/Sqltoolsps.yml","https://twitter.com/pabraeken/status/993298228840992768"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1127"],"path":"rules/windows/process_creation/proc_creation_win_mssql_sqltoolsps_susp_execution.yml","techniques":["T1059.001","T1127"],"cves":[]},{"id":"a7df0e9e-91a5-459a-a003-4cde67c2ff5d","title":"Potentially Suspicious Command Executed Via Run Dialog Box - Registry","author":"Ahmed Farouk, Nasreddine Bencherchali","status":"test","level":"high","date":"2024-11-01","modified":null,"description":"Detects execution of commands via the run dialog box on Windows by checking values of the \"RunMRU\" registry key.\nThis technique was seen being abused by threat actors to deceive users into pasting and executing malicious commands, often disguised as CAPTCHA verification steps.\n","references":["https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf","https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71","https://www.forensafe.com/blogs/runmrukey.html","https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/registry/registry_set/registry_set_runmru_susp_command_execution.yml","techniques":["T1059.001"],"cves":[]},{"id":"aa35a627-33fb-4d04-a165-d33b4afca3e8","title":"Remote LSASS Process Access Through Windows Remote Management","author":"Patryk Prauze - ING Tech","status":"stable","level":"high","date":"2019-05-20","modified":"2023-11-29","description":"Detects remote access to the LSASS process via WinRM. This could be a sign of credential dumping from tools like mimikatz.","references":["https://pentestlab.blog/2018/05/15/lateral-movement-winrm/"],"logsource":{"product":"windows","category":"process_access"},"tags":["attack.credential-access","attack.execution","attack.t1003.001","attack.t1059.001","attack.lateral-movement","attack.t1021.006","attack.s0002"],"path":"rules/windows/process_access/proc_access_win_lsass_remote_access_trough_winrm.yml","techniques":["T1003.001","T1059.001","T1021.006"],"cves":[]},{"id":"ac175779-025a-4f12-98b0-acdaeb77ea85","title":"PowerShell Script Run in AppData","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"medium","date":"2019-01-09","modified":"2022-07-14","description":"Detects a suspicious command line execution that invokes PowerShell with reference to an AppData folder","references":["https://twitter.com/JohnLaTwC/status/1082851155481288706","https://app.any.run/tasks/f87f1c4e-47e2-4c46-9cf4-31454c06ce03"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_susp_ps_appdata.yml","techniques":["T1059.001"],"cves":[]},{"id":"ac20ae82-8758-4f38-958e-b44a3140ca88","title":"Invoke-Obfuscation Via Use MSHTA","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-08","modified":"2022-03-08","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_mhsta.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"ac7102b4-9e1e-4802-9b4f-17c5524c015c","title":"New PowerShell Instance Created","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"informational","date":"2019-09-12","modified":"2023-11-30","description":"Detects the execution of PowerShell via the creation of a named pipe starting with PSHost","references":["https://threathunterplaybook.com/hunts/windows/190610-PwshAlternateHosts/notebook.html","https://threathunterplaybook.com/hunts/windows/190410-LocalPwshExecution/notebook.html"],"logsource":{"product":"windows","category":"pipe_created"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/pipe_created/pipe_created_powershell_execution_pipe.yml","techniques":["T1059.001"],"cves":[]},{"id":"ad1f4bb9-8dfb-4765-adb6-2a7cfb6c0f94","title":"Suspicious WSMAN Provider Image Loads","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-06-24","modified":"2026-07-28","description":"Detects signs of potential use of the WSMAN provider from uncommon processes locally and remote execution.","references":["https://twitter.com/chadtilbury/status/1275851297770610688","https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/","https://learn.microsoft.com/en-us/windows/win32/winrm/windows-remote-management-architecture","https://github.com/bohops/WSMan-WinRM"],"logsource":{"product":"windows","category":"image_load"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.003"],"path":"rules/windows/image_load/image_load_wsman_provider_image_load.yml","techniques":["T1059.001","T1021.003"],"cves":[]},{"id":"ad856965-f44d-42a8-945e-bbf7bd03d05a","title":"Invocation Of Crypto-Classes From The \"Cryptography\" PowerShell Namespace","author":"Andreas Braathen (mnemonic.io)","status":"test","level":"medium","date":"2023-12-01","modified":null,"description":"Detects the invocation of PowerShell commands with references to classes from the \"System.Security.Cryptography\" namespace.\nThe PowerShell namespace \"System.Security.Cryptography\" provides classes for on-the-fly encryption and decryption.\nThese can be used for example in decrypting malicious payload for defense evasion.\n","references":["https://learn.microsoft.com/en-us/dotnet/api/system.security.cryptography?view=net-8.0","https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html","https://www.virustotal.com/gui/file/39102fb7bb6a74a9c8cb6d46419f9015b381199ea8524c1376672b30fffd69d2"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027.010","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_crypto_namespace.yml","techniques":["T1059.001","T1027.010"],"cves":[]},{"id":"ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71","title":"Suspicious PowerShell Invocations - Specific","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro","status":"test","level":"high","date":"2017-03-05","modified":"2025-02-17","description":"Detects suspicious PowerShell invocation command parameters","references":["Internal Research","https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_invocation_specific.yml","techniques":["T1059.001"],"cves":[]},{"id":"afd3df04-948d-46f6-ae44-25966c44b97f","title":"PSAsyncShell - Asynchronous TCP Reverse Shell","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-10-04","modified":null,"description":"Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell","references":["https://github.com/JoelGMSec/PSAsyncShell"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_psasyncshell.yml","techniques":["T1059.001"],"cves":[]},{"id":"b222df08-0e07-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-17","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"b3512211-c67e-4707-bedc-66efc7848863","title":"Potential PowerShell Downgrade Attack","author":"Harish Segar (rule)","status":"test","level":"medium","date":"2020-03-20","modified":"2023-01-04","description":"Detects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0","references":["http://www.leeholmes.com/blog/2017/03/17/detecting-and-preventing-powershell-downgrade-attacks/","https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#bypass-or-avoid-amsi-by-version-downgrade-"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_downgrade_attack.yml","techniques":["T1059.001"],"cves":[]},{"id":"b377ddab-502d-4519-9e8c-5590033d2d70","title":"Lace Tempest PowerShell Evidence Eraser","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2023-11-09","modified":null,"description":"Detects a PowerShell script used by Lace Tempest APT to erase evidence from victim servers by exploiting CVE-2023-47246 as reported by SysAid Team\n","references":["https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_eraser_script.yml","techniques":["T1059.001"],"cves":[]},{"id":"b66474aa-bd92-4333-a16c-298155b120df","title":"Potential Persistence Via Powershell Search Order Hijacking - Task","author":"pH-T (Nextron Systems), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-08","modified":"2023-02-03","description":"Detects suspicious powershell execution via a schedule task where the command ends with an suspicious flags to hide the powershell instance instead of executeing scripts or commands. This could be a sign of persistence via PowerShell \"Get-Variable\" technique as seen being used in Colibri Loader","references":["https://blog.malwarebytes.com/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_powershell_persistence.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"b6b49cd1-34d6-4ead-b1bf-176e9edba9a4","title":"Potential PowerShell Obfuscation Via Reversed Commands","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","status":"test","level":"high","date":"2020-10-11","modified":"2023-05-31","description":"Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers","references":["https://2019.offzone.moscow/ru/report/hunting-for-powershell-abuses/","https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=66"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cmdline_reversed_strings.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"b7155193-8a81-4d8f-805d-88de864ca50c","title":"UNC2452 PowerShell Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"critical","date":"2021-01-20","modified":"2022-10-09","description":"Detects a specific PowerShell command line pattern used by the UNC2452 actors as mentioned in Microsoft and Symantec reports","references":["https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/solarwinds-raindrop-malware","https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1047/T1047.md#atomic-test-7---create-a-process-using-wmi-query-and-an-encoded-command"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","attack.t1047","detection.emerging-threats"],"path":"rules-emerging-threats/2020/TA/SolarWinds-Supply-Chain/proc_creation_win_apt_unc2452_ps.yml","techniques":["T1059.001","T1047"],"cves":[]},{"id":"b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5","title":"PowerShell PSAttack","author":"Sean Metcalf (source), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-05","modified":"2022-12-25","description":"Detects the use of PSAttack PowerShell hack tool","references":["https://adsecurity.org/?p=2921"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_psattack.yml","techniques":["T1059.001"],"cves":[]},{"id":"b9d9cc83-380b-4ba3-8d8f-60c0e7e2930c","title":"Suspicious PowerShell Encoded Command Patterns","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-05-24","modified":"2023-01-05","description":"Detects PowerShell command line patterns in combincation with encoded commands that often appear in malware infection chains","references":["https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd_patterns.yml","techniques":["T1059.001"],"cves":[]},{"id":"bb780e0c-16cf-4383-8383-1e5471db6cf9","title":"Suspicious XOR Encoded PowerShell Command","author":"Sami Ruohonen, Harish Segar, Tim Shelton, Teymur Kheirkhabarov, Vasiliy Burov, oscd.community, Nasreddine Bencherchali","status":"test","level":"medium","date":"2018-09-05","modified":"2023-01-30","description":"Detects presence of a potentially xor encoded powershell command","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65","https://redcanary.com/blog/yellow-cockatoo/","https://zero2auto.com/2020/05/19/netwalker-re/","https://mez0.cc/posts/cobaltstrike-powershell-exec/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1140","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_xor_commandline.yml","techniques":["T1059.001","T1140","T1027"],"cves":[]},{"id":"bbb80e91-5746-4fbe-8898-122e2cafdbf4","title":"Suspicious PowerShell Invocations - Generic - PowerShell Module","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-12","modified":"2023-01-03","description":"Detects suspicious PowerShell invocation command parameters","references":["Internal Research"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml","techniques":["T1059.001"],"cves":[]},{"id":"bf72941a-cba0-41ea-b18c-9aca3925690d","title":"PowerShell ADRecon Execution","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-07-16","modified":"2022-09-06","description":"Detects execution of ADRecon.ps1 for AD reconnaissance which has been reported to be actively used by FIN7","references":["https://github.com/sense-of-security/ADRecon/blob/11881a24e9c8b207f31b56846809ce1fb189bcc9/ADRecon.ps1","https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.discovery","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml","techniques":["T1059.001"],"cves":[]},{"id":"c260b6db-48ba-4b4a-a76f-2f67644e99d2","title":"HackTool - Covenant PowerShell Launcher","author":"Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community","status":"test","level":"high","date":"2020-06-04","modified":"2023-02-21","description":"Detects suspicious command lines used in Covenant luanchers","references":["https://posts.specterops.io/covenant-v0-5-eee0507b85ba"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1564.003"],"path":"rules/windows/process_creation/proc_creation_win_hktl_covenant.yml","techniques":["T1059.001","T1564.003"],"cves":[]},{"id":"c31364f7-8be6-4b77-8483-dd2b5a7b69a3","title":"Import PowerShell Modules From Suspicious Directories - ProcCreation","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"medium","date":"2023-01-10","modified":null,"description":"Detects powershell scripts that import modules from suspicious directories","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1003.002/T1003.002.md"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_import_module_susp_dirs.yml","techniques":["T1059.001"],"cves":[]},{"id":"c4eeeeae-89f4-43a7-8b48-8d1bdfa66c78","title":"Scheduled Task Executing Encoded Payload from Registry","author":"pH-T (Nextron Systems), @Kostastsale, TheDFIRReport, X__Junior (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-02-12","modified":"2023-02-04","description":"Detects the creation of a schtask that potentially executes a base64 encoded payload stored in the Windows Registry using PowerShell.","references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_reg_loader_encoded.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"c539afac-c12a-46ed-b1bd-5a5567c9f045","title":"Potential Remote PowerShell Session Initiated","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"high","date":"2019-09-12","modified":"2024-02-02","description":"Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.\nThis could potentially indicates a remote PowerShell connection.\n","references":["https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html"],"logsource":{"product":"windows","category":"network_connection"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.006"],"path":"rules/windows/network_connection/net_connection_win_susp_remote_powershell_session.yml","techniques":["T1059.001","T1021.006"],"cves":[]},{"id":"c5b20776-639a-49bf-94c7-84f912b91c15","title":"Netcat The Powershell Version","author":"frack113","status":"test","level":"medium","date":"2021-07-21","modified":"2023-10-27","description":"Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network","references":["https://nmap.org/ncat/","https://github.com/besimorhino/powercat","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.command-and-control","attack.execution","attack.t1095","attack.t1059.001"],"path":"rules/windows/powershell/powershell_classic/posh_pc_powercat.yml","techniques":["T1095","T1059.001"],"cves":[]},{"id":"c5c00f49-b3f9-45a6-997e-cfdecc6e1967","title":"Suspicious Schtasks Execution AppData Folder","author":"pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-03-15","modified":"2022-07-28","description":"Detects the creation of a schtask that executes a file from C:\\Users\\<USER>\\AppData\\Local","references":["https://thedfirreport.com/2022/02/21/qbot-and-zerologon-lead-to-full-domain-compromise/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.execution","attack.persistence","attack.t1053.005","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_schtasks_appdata_local_system.yml","techniques":["T1053.005","T1059.001"],"cves":[]},{"id":"c70e019b-1479-4b65-b0cc-cd0c6093a599","title":"PowerShell Called from an Executable Version Mismatch","author":"Sean Metcalf (source), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-05","modified":"2023-10-27","description":"Detects PowerShell called from an executable by the version mismatch method","references":["https://adsecurity.org/?p=2921"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_classic/posh_pc_exe_calling_ps.yml","techniques":["T1059.001"],"cves":[]},{"id":"c72aca44-8d52-45ad-8f81-f96c4d3c755e","title":"Invoke-Obfuscation Via Stdin - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-12","modified":"2024-04-05","description":"Detects Obfuscated Powershell via Stdin in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"c86133ad-4725-4bd0-8170-210788e0a7ba","title":"Net WebClient Casing Anomalies","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-05-24","modified":"2023-01-05","description":"Detects PowerShell command line contents that include a suspicious abnormal casing in the Net.Webclient (e.g. nEt.WEbCliEnT) string as used in obfuscation techniques","references":["https://app.any.run/tasks/b9040c63-c140-479b-ad59-f1bb56ce7a97/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_webclient_casing.yml","techniques":["T1059.001"],"cves":[]},{"id":"ca2092a1-c273-4878-9b4b-0d60115bf5ea","title":"Suspicious Encoded PowerShell Command Line","author":"Florian Roth (Nextron Systems), Markus Neis, Jonhnathan Ribeiro, Daniil Yugoslavskiy, Anton Kutepov, oscd.community","status":"test","level":"high","date":"2018-09-03","modified":"2023-04-06","description":"Detects suspicious powershell process starts with base64 encoded commands (e.g. Emotet)","references":["https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_encoded_cmd.yml","techniques":["T1059.001"],"cves":[]},{"id":"ca8b77a9-d499-4095-b793-5d5f330d450e","title":"PowerShell Credential Prompt","author":"John Lambert (idea), Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-04-09","modified":"2022-12-25","description":"Detects PowerShell calling a credential prompt","references":["https://twitter.com/JohnLaTwC/status/850381440629981184","https://t.co/ezOTGy1a1G"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.credential-access","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml","techniques":["T1059.001"],"cves":[]},{"id":"cc08d590-8b90-413a-aff6-31d1a99678d7","title":"Suspicious PrinterPorts Creation (CVE-2020-1048)","author":"EagleEye Team, Florian Roth","status":"test","level":"high","date":"2020-05-13","modified":"2021-11-27","description":"Detects new commands that add new printer port which point to suspicious file","references":["https://windows-internals.com/printdemon-cve-2020-1048/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.persistence","attack.execution","attack.t1059.001","cve.2020-1048","detection.emerging-threats"],"path":"rules-emerging-threats/2020/Exploits/CVE-2020-1048/proc_creation_win_exploit_cve_2020_1048.yml","techniques":["T1059.001"],"cves":["CVE-2020-1048"]},{"id":"cd0f7229-d16f-42de-8fe3-fba365fbcb3a","title":"Invoke-Obfuscation Via Use Rundll32 - Security","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use Rundll32 in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_use_rundll32_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"cdf05894-89e7-4ead-b2b0-0a5f97a90f2f","title":"Potential Encoded PowerShell Patterns In CommandLine","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton","status":"test","level":"low","date":"2020-10-11","modified":"2023-01-26","description":"Detects specific combinations of encoding methods in PowerShell via the commandline","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=65"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_encoding_patterns.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"d02e8cf5-6099-48cf-9bfc-1eec2d0c7b18","title":"Potential Emotet Activity","author":"Florian Roth (Nextron Systems)","status":"stable","level":"high","date":"2019-09-30","modified":"2023-02-04","description":"Detects all Emotet like process executions that are not covered by the more generic rules","references":["https://app.any.run/tasks/e13ab713-64cf-4b23-ad93-6dceaa5429ac/","https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/","https://app.any.run/tasks/97f875e8-0e08-4328-815f-055e971ba754/","https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027","detection.emerging-threats"],"path":"rules-emerging-threats/2019/Malware/Emotet/proc_creation_win_malware_emotet.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"d0d28567-4b9a-45e2-8bbc-fb1b66a1f7f6","title":"Unusually Long PowerShell CommandLine","author":"oscd.community, Natalia Shornikova","status":"test","level":"low","date":"2020-10-06","modified":"2023-04-14","description":"Detects unusually long PowerShell command lines with a length of 1000 characters or more","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_abnormal_commandline_size.yml","techniques":["T1059.001"],"cves":[]},{"id":"d52d2e87-eb03-4fac-961d-eb616da79788","title":"Raspberry Robin Subsequent Execution of Commands","author":"@kostastsale","status":"test","level":"high","date":"2022-05-06","modified":null,"description":"Detects raspberry robin subsequent execution of commands.","references":["https://redcanary.com/blog/raspberry-robin/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Malware/Raspberry-Robin/proc_creation_win_malware_raspberry_robin_execution.yml","techniques":["T1059.001"],"cves":[]},{"id":"d7326048-328b-4d5e-98af-86e84b17c765","title":"Uncommon PowerShell Hosts","author":"Roberto Rodriguez @Cyb3rWard0g","status":"test","level":"medium","date":"2019-08-11","modified":"2025-10-22","description":"Detects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe","references":["https://threathunterplaybook.com/hunts/windows/190815-RemoteServiceInstallation/notebook.html"],"logsource":{"product":"windows","category":"ps_classic_start"},"tags":["attack.execution","attack.t1059.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/powershell/powershell_classic/posh_pc_alternate_powershell_hosts.yml","techniques":["T1059.001"],"cves":[]},{"id":"d7bcd677-645d-4691-a8d4-7a5602b780d1","title":"Potential PowerShell Command Line Obfuscation","author":"Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp)","status":"test","level":"high","date":"2020-10-15","modified":"2024-04-15","description":"Detects the PowerShell command lines with special characters","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=64"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1027","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_cmdline_special_characters.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"db92dd33-a3ad-49cf-8c2c-608c3e30ace0","title":"Invoke-Obfuscation Via Use Clip - Powershell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2024-04-15","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"dcd74b95-3f36-4ed9-9598-0490951643aa","title":"PowerView PowerShell Cmdlets - ScriptBlock","author":"Bhabesh Raj","status":"test","level":"high","date":"2021-05-18","modified":"2023-11-22","description":"Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.","references":["https://powersploit.readthedocs.io/en/stable/Recon/README","https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon","https://thedfirreport.com/2020/10/08/ryuks-return","https://adsecurity.org/?p=2277"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml","techniques":["T1059.001"],"cves":[]},{"id":"dcf2db1f-f091-425b-a821-c05875b8925a","title":"Invoke-Obfuscation VAR+ Launcher - Security","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-15","modified":"2022-11-29","description":"Detects Obfuscated use of Environment Variables to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_var_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"de41232e-12e8-49fa-86bc-c05c7e722df9","title":"Suspicious PowerShell Download - PoshModule","author":"Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-03-05","modified":"2023-01-20","description":"Detects suspicious PowerShell download command","references":["https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-8.0","https://learn.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadstring?view=net-8.0"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_susp_download.yml","techniques":["T1059.001"],"cves":[]},{"id":"df9a0e0e-fedb-4d6c-8668-d765dfc92aa7","title":"Suspicious Non PowerShell WSMAN COM Provider","author":"Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)","status":"test","level":"medium","date":"2020-06-24","modified":"2025-10-22","description":"Detects suspicious use of the WSMAN provider without PowerShell.exe as the host application.","references":["https://twitter.com/chadtilbury/status/1275851297770610688","https://bohops.com/2020/05/12/ws-management-com-another-approach-for-winrm-lateral-movement/","https://github.com/bohops/WSMan-WinRM"],"logsource":{"product":"windows","service":"powershell-classic"},"tags":["attack.execution","attack.t1059.001","attack.lateral-movement","attack.t1021.003"],"path":"rules/windows/powershell/powershell_classic/posh_pc_wsman_com_provider_no_powershell.yml","techniques":["T1059.001","T1021.003"],"cves":[]},{"id":"e0a41412-c69a-446f-8e6e-0e6d7483dad7","title":"CVE-2022-24527 Microsoft Connected Cache LPE","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-04-13","modified":null,"description":"Detects files created during the local privilege exploitation of CVE-2022-24527 Microsoft Connected Cache","references":["https://www.rapid7.com/blog/post/2022/04/12/cve-2022-24527-microsoft-connected-cache-local-privilege-escalation-fixed/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.privilege-escalation","attack.t1059.001","cve.2022-24527","detection.emerging-threats"],"path":"rules-emerging-threats/2022/Exploits/CVE-2022-24527/file_event_win_cve_2022_24527_lpe.yml","techniques":["T1059.001"],"cves":["CVE-2022-24527"]},{"id":"e1561947-b4e3-4a74-9bdd-83baed21bdb5","title":"Invoke-Obfuscation Via Use Clip","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2026-03-16","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_use_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e312efd0-35a1-407f-8439-b8d434b438a6","title":"Potential PowerShell Obfuscation Via WCHAR/CHAR","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-07-09","modified":"2025-03-03","description":"Detects suspicious encoded character syntax often used for defense evasion","references":["https://twitter.com/0gtweet/status/1281103918693482496"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.stealth","attack.t1059.001","attack.t1027"],"path":"rules/windows/process_creation/proc_creation_win_powershell_obfuscation_via_utf8.yml","techniques":["T1059.001","T1027"],"cves":[]},{"id":"e32d4572-9826-4738-b651-95fa63747e8a","title":"Base64 Encoded PowerShell Command Detected","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2020-01-29","modified":"2023-01-26","description":"Detects usage of the \"FromBase64String\" function in the commandline which is used to decode a base64 encoded string","references":["https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1140","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_frombase64string.yml","techniques":["T1027","T1140","T1059.001"],"cves":[]},{"id":"e4b6d2a7-d8a4-4f19-acbd-943c16d90647","title":"Potentially Suspicious PowerShell Child Processes","author":"Florian Roth (Nextron Systems), Tim Shelton","status":"test","level":"medium","date":"2022-04-26","modified":"2024-07-16","description":"Detects potentially suspicious child processes spawned by PowerShell.\nUse this rule to hunt for potential anomalies initiating from PowerShell scripts and commands.\n","references":["https://twitter.com/ankit_anubhav/status/1518835408502620162"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_powershell_susp_child_processes.yml","techniques":["T1059.001"],"cves":[]},{"id":"e54f5149-6ba3-49cf-b153-070d24679126","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e55a5195-4724-480e-a77e-3ebe64bd3759","title":"Invoke-Obfuscation Via Use MSHTA - PowerShell","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-08","modified":"2022-11-29","description":"Detects Obfuscated Powershell via use MSHTA in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e6c54d94-498c-4562-a37c-b469d8e9a275","title":"Suspicious PowerShell Download and Execute Pattern","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2022-02-28","modified":"2022-03-01","description":"Detects suspicious PowerShell download patterns that are often used in malicious scripts, stagers or downloaders (make sure that your backend applies the strings case-insensitive)","references":["https://gist.github.com/jivoi/c354eaaf3019352ce32522f916c03d70","https://www.trendmicro.com/en_us/research/22/j/lv-ransomware-exploits-proxyshell-in-attack.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_susp_download_patterns.yml","techniques":["T1059.001"],"cves":[]},{"id":"e6cb92b4-b470-4eb8-8a9d-d63e8583aae0","title":"Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e8314f79-564d-4f79-bc13-fbc0bf2660d8","title":"Potential PowerShell Obfuscation Using Character Join","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-01-09","modified":null,"description":"Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation","references":["Internal Research"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.stealth","attack.t1027","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_alias_obfscuation.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"e8a95b5e-c891-46e2-b33a-93937d3abc31","title":"Suspicious HH.EXE Execution","author":"Maxim Pavlunin","status":"test","level":"high","date":"2020-04-01","modified":"2023-04-12","description":"Detects a suspicious execution of a Microsoft HTML Help (HH.exe)","references":["https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/chm-badness-delivers-a-banking-trojan/","https://github.com/elastic/protections-artifacts/commit/746086721fd385d9f5c6647cada1788db4aea95f#diff-27939090904026cc396b0b629c8e4314acd6f5dac40a676edbc87f4567b47eb7","https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/higaisa-or-winnti-apt-41-backdoors-old-and-new/","https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.initial-access","attack.stealth","attack.t1047","attack.t1059.001","attack.t1059.003","attack.t1059.005","attack.t1059.007","attack.t1218","attack.t1218.001","attack.t1218.010","attack.t1218.011","attack.t1566","attack.t1566.001"],"path":"rules/windows/process_creation/proc_creation_win_hh_susp_execution.yml","techniques":["T1047","T1059.001","T1059.003","T1059.005","T1059.007","T1218","T1218.001","T1218.010","T1218.011","T1566","T1566.001"],"cves":[]},{"id":"e99375eb-3ee0-407a-9f90-79569cc6a01c","title":"Kalambur Backdoor Curl TOR SOCKS Proxy Execution","author":"Arda Buyukkaya (EclecticIQ)","status":"experimental","level":"high","date":"2025-02-11","modified":null,"description":"Detects the execution of the \"curl.exe\" command, referencing \"SOCKS\" and \".onion\" domains, which could be indicative of Kalambur backdoor activity.","references":["https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.command-and-control","attack.t1090","attack.t1573","attack.t1071.001","attack.t1059.001","attack.s0183","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/proc_creation_win_malware_kalambur_curl_socks_tor.yml","techniques":["T1090","T1573","T1071.001","T1059.001"],"cves":[]},{"id":"e9f55347-2928-4c06-88e5-1a7f8169942e","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2022-11-16","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_invoke_obfuscation_via_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"ebdf49d8-b89c-46c9-8fdf-2c308406f6bd","title":"Invoke-Obfuscation Via Use Clip - PowerShell Module","author":"Nikita Nazarov, oscd.community","status":"test","level":"high","date":"2020-10-09","modified":"2024-04-05","description":"Detects Obfuscated Powershell via use Clip.exe in Scripts","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"ed965133-513f-41d9-a441-e38076a0798f","title":"Suspicious PowerShell Invocations - Generic","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2017-03-12","modified":"2023-01-03","description":"Detects suspicious PowerShell invocation command parameters","references":["Internal Research"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_invocation_generic.yml","techniques":["T1059.001"],"cves":[]},{"id":"edc2f8ae-2412-4dfd-b9d5-0c57727e70be","title":"Potential Powershell ReverseShell Connection","author":"FPT.EagleEye, wagga, Nasreddine Bencherchali (Nextron Systems)","status":"stable","level":"high","date":"2021-03-03","modified":"2023-04-05","description":"Detects usage of the \"TcpClient\" class. Which can be abused to establish remote connections and reverse-shells. As seen used by the Nishang \"Invoke-PowerShellTcpOneLine\" reverse shell and other.","references":["https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/","https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/","https://github.com/samratashok/nishang/blob/414ee1104526d7057f9adaeee196d91ae447283e/Shells/Invoke-PowerShellTcpOneLine.ps1"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_reverse_shell_connection.yml","techniques":["T1059.001"],"cves":[]},{"id":"ee218c12-627a-4d27-9e30-d6fb2fe22ed2","title":"Powershell Inline Execution From A File","author":"frack113","status":"test","level":"medium","date":"2022-12-25","modified":null,"description":"Detects inline execution of PowerShell code from a file","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_exec_data_file.yml","techniques":["T1059.001"],"cves":[]},{"id":"eeb2e3dc-c1f4-40dd-9bd5-149ee465ad50","title":"Remote Thread Creation Via PowerShell","author":"Nikita Nazarov, oscd.community","status":"test","level":"medium","date":"2020-10-06","modified":"2023-11-10","description":"Detects the creation of a remote thread from a Powershell process to another process","references":["https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse"],"logsource":{"product":"windows","category":"create_remote_thread"},"tags":["attack.execution","attack.t1059.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/create_remote_thread/create_remote_thread_win_powershell_generic.yml","techniques":["T1059.001"],"cves":[]},{"id":"f0507c0f-a3a2-40f5-acc6-7f543c334993","title":"Suspicious File Execution From Internet Hosted WebDav Share","author":"pH-T (Nextron Systems)","status":"test","level":"high","date":"2022-09-01","modified":"2023-02-21","description":"Detects the execution of the \"net use\" command to mount a WebDAV server and then immediately execute some content in it. As seen being used in malicious LNK files","references":["https://twitter.com/ShadowChasing1/status/1552595370961944576","https://www.virustotal.com/gui/file/a63376ee1dba76361df73338928e528ca5b20171ea74c24581605366dcaa0104/behavior"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_cmd_net_use_and_exec_combo.yml","techniques":["T1059.001"],"cves":[]},{"id":"f241cf1b-3a6b-4e1a-b4f9-133c00dd95ca","title":"Invoke-Obfuscation RUNDLL LAUNCHER - Security","author":"Timur Zinniatullin, oscd.community","status":"test","level":"medium","date":"2020-10-18","modified":"2022-11-29","description":"Detects Obfuscated Powershell via RUNDLL LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"security"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/security/win_security_invoke_obfuscation_via_rundll_services_security.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"f26c6093-6f14-4b12-800f-0fcb46f5ffd0","title":"Malicious Base64 Encoded PowerShell Keywords in Command Lines","author":"John Lambert (rule)","status":"test","level":"high","date":"2019-01-16","modified":"2023-01-05","description":"Detects base64 encoded strings used in hidden malicious PowerShell command lines","references":["http://www.leeholmes.com/blog/2017/09/21/searching-for-content-in-base-64-strings/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_hidden_flag.yml","techniques":["T1059.001"],"cves":[]},{"id":"f331aa1f-8c53-4fc3-b083-cc159bc971cb","title":"Malicious PowerShell Scripts - FileCreation","author":"Markus Neis, Nasreddine Bencherchali (Nextron Systems), Mustafa Kaan Demir, Georg Lauenstein","status":"test","level":"high","date":"2018-04-07","modified":"2025-12-10","description":"Detects the creation of known offensive powershell scripts used for exploitation","references":["https://github.com/PowerShellMafia/PowerSploit","https://github.com/NetSPI/PowerUpSQL","https://github.com/CsEnox/EventViewer-UACBypass","https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu","https://github.com/nettitude/Invoke-PowerThIEf","https://github.com/S3cur3Th1sSh1t/WinPwn","https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries","https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1","https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1","https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1","https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1","https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/","https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/","https://github.com/HarmJ0y/DAMP","https://github.com/samratashok/nishang","https://github.com/DarkCoderSc/PowerRunAsSystem/","https://github.com/besimorhino/powercat","https://github.com/Kevin-Robertson/Powermad","https://github.com/adrecon/ADRecon","https://github.com/adrecon/AzureADRecon","https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1","https://github.com/The-Viper-One/Invoke-PowerDPAPI/","https://github.com/Arno0x/DNSExfiltrator/"],"logsource":{"product":"windows","category":"file_event"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/file/file_event/file_event_win_powershell_exploit_scripts.yml","techniques":["T1059.001"],"cves":[]},{"id":"f376c8a7-a2d0-4ddc-aa0c-16c17236d962","title":"HackTool - Bloodhound/Sharphound Execution","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-12-20","modified":"2023-02-04","description":"Detects command line parameters used by Bloodhound and Sharphound hack tools","references":["https://github.com/BloodHoundAD/BloodHound","https://github.com/BloodHoundAD/SharpHound"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.discovery","attack.t1087.001","attack.t1087.002","attack.t1482","attack.t1069.001","attack.t1069.002","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_hktl_bloodhound_sharphound.yml","techniques":["T1087.001","T1087.002","T1482","T1069.001","T1069.002","T1059.001"],"cves":[]},{"id":"f3c89218-8c3d-4ba9-9974-f1d8e6a1b4a6","title":"Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module","author":"Timur Zinniatullin, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2024-04-05","description":"Detects Obfuscated Powershell via VAR++ LAUNCHER","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","category":"ps_module"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"f4bbd493-b796-416e-bbf2-121235348529","title":"Non Interactive PowerShell Process Spawned","author":"Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements)","status":"test","level":"low","date":"2019-09-12","modified":"2025-02-28","description":"Detects non-interactive PowerShell activity by looking at the \"powershell\" process with a non-user GUI process such as \"explorer.exe\" as a parent.","references":["https://web.archive.org/web/20200925032237/https://threathunterplaybook.com/notebooks/windows/02_execution/WIN-190410151110.html"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_non_interactive_execution.yml","techniques":["T1059.001"],"cves":[]},{"id":"f62176f3-8128-4faa-bf6c-83261322e5eb","title":"Malicious PowerShell Keywords","author":"Sean Metcalf (source), Florian Roth (Nextron Systems)","status":"test","level":"medium","date":"2017-03-05","modified":"2023-06-20","description":"Detects keywords from well-known PowerShell exploitation frameworks","references":["https://adsecurity.org/?p=2921"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml","techniques":["T1059.001"],"cves":[]},{"id":"f7385ee2-0e0c-11eb-adc1-0242ac120002","title":"Invoke-Obfuscation CLIP+ Launcher - System","author":"Jonathan Cheong, oscd.community","status":"test","level":"high","date":"2020-10-13","modified":"2023-02-20","description":"Detects Obfuscated use of Clip.exe to execute PowerShell","references":["https://github.com/SigmaHQ/sigma/issues/1009"],"logsource":{"product":"windows","service":"system"},"tags":["attack.stealth","attack.t1027","attack.execution","attack.t1059.001"],"path":"rules/windows/builtin/system/service_control_manager/win_system_invoke_obfuscation_clip_services.yml","techniques":["T1027","T1059.001"],"cves":[]},{"id":"f772cee9-b7c2-4cb2-8f07-49870adc02e0","title":"Malicious Nishang PowerShell Commandlets","author":"Alec Costello","status":"test","level":"high","date":"2019-05-16","modified":"2023-01-16","description":"Detects Commandlet names and arguments from the Nishang exploitation framework","references":["https://github.com/samratashok/nishang"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml","techniques":["T1059.001"],"cves":[]},{"id":"fb843269-508c-4b76-8b8d-88679db22ce7","title":"Suspicious Execution of Powershell with Base64","author":"frack113","status":"test","level":"medium","date":"2022-01-02","modified":"2023-01-05","description":"Commandline to launch powershell with a base64 payload","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-20---powershell-invoke-known-malicious-cmdlets","https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/","https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_encode.yml","techniques":["T1059.001"],"cves":[]},{"id":"fb9d3ff7-7348-46ab-af8c-b55f5fbf39b4","title":"Execution of Powershell Script in Public Folder","author":"Max Altgelt (Nextron Systems)","status":"test","level":"high","date":"2022-04-06","modified":"2022-07-14","description":"This rule detects execution of PowerShell scripts located in the \"C:\\Users\\Public\" folder","references":["https://www.mandiant.com/resources/evolution-of-fin7"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_public_folder.yml","techniques":["T1059.001"],"cves":[]},{"id":"fdb62a13-9a81-4e5c-a38f-ea93a16f6d7c","title":"PowerShell Base64 Encoded FromBase64String Cmdlet","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-08-24","modified":"2023-04-06","description":"Detects usage of a base64 encoded \"FromBase64String\" cmdlet in a process command line","references":["Internal Research"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1140","attack.execution","attack.t1059.001"],"path":"rules/windows/process_creation/proc_creation_win_powershell_base64_frombase64string.yml","techniques":["T1140","T1059.001"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2022-41082","state":"mapped","mapping_types":["exploitation_technique","primary_impact"]}],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}