Potential Pentesting PowerShell Script

[rule]
description = "Identifies the execution of PowerShell scripts with keywords from known open source penetration testing tools."
id = "c4cd4b82-6a78-484e-a86f-470381006ab5"
license = "Elastic License v2"
name = "Potential Pentesting PowerShell Script"
os_list = ["windows"]
version = "1.0.6"

query = '''
api where process.Ext.api.name == "AmsiScanBuffer" and
 (process.name in~ ("powershell.exe") or process.Ext.api.parameters.app_name == "PowerShell") and
  process.Ext.api.parameters.buffer : ("*Invoke-Empire*", "*Invoke-Mimikatz*", "*PowerShellMafia*", "*redcanaryco*", "*PowerShellEmpire*",
    "*EDR-Testing-Script*", "*0xfc,0xe8,0x82,0x0,0x0,0x0,0x60*", "*Get-VaultCredential*", "*Get-ChromeBookmarks*", "*Get-USBKeystrokes *",
    "*Get-Keystrokes*", "*Get-ClipboardContents*", "*Get-Keystrokes*", "*Get-Screenshot*", "*Get-GPPPassword*", "*Exploit-Jenkins*", "*New-InMemoryModule*",
    "*Invoke-CreateRemoteThread*", "*Invoke-PowerSpray*", "*Invoke-NetRipper*",
    "*Invoke-CredentialInjection*", "*Invoke-DllInjection*", "*Invoke-DpapiDump*",
    "*Invoke-EventVwrBypass*", "*Invoke-ImpersonateUser*", "*Invoke-HiveDump*",
    "*Invoke-Kerberoast*", "*Invoke-MemoryFreeLibrary*", "*Invoke-Patamenia*",
    "*Invoke-MemoryLoadLibrary*", "*Invoke-SMBRemoting*", "*Invoke-WMIRemoting*",
    "*Invoke-Mimikatz*", "*Invoke-NinjaCopy*", "*Invoke-GrabTheHash*",
    "*Invoke-PatchDll*", "*Invoke-Portscan*", "*Invoke-SessionHunter*",
    "*Invoke-PrivescAudit*", "*Invoke-ReflectivePEInjection*",
    "*Invoke-ReverseDnsLookup*", "*Invoke-RevertToSelf*", "*Invoke-PrivescCheck*",
    "*Invoke-ServiceAbuse*", "*Invoke-Shellcode*",
    "*Invoke-TokenManipulation*", "*Invoke-UserImpersonation*",
    "*Invoke-WmiCommand*", "*Invoke-Privesc*", "*Invoke-BloodHound*",
    "*Invoke-HostEnum*", "*Invoke-BruteForce*",
    "*Invoke-SessionGopher*", "*Invoke-AsSystem*",
    "*Invoke-WdigestDowngrade*",
    "*Invoke-DomainPasswordSpray*",
    "*Invoke-DCSync*", "*Invoke-PowerDump*", "*Invoke-SSIDExfil*",
    "*Invoke-PowerShellTCP*", "*Invoke-DropboxUpload*",
    "*Invoke-ExfilDataToGitHub*", "*Invoke-EgressCheck*",
    "*Invoke-PostExfil*", "*Invoke-NetworkRelay*",
    "*Invoke-WMIDebugger*", "*Invoke-SQLOSCMD*",
    "*Invoke-SMBExec*", "*Invoke-PSRemoting*",
    "*Invoke-ExecuteMSBuild*", "*Invoke-DCOM*",
    "*Invoke-Inveigh*", "*Invoke-PsExec*",
    "*Invoke-ResolverBackdoor*", "*Invoke-EventLogBackdoor*",
    "*Invoke-DeadUserBackdoor*", "*Invoke-DisableMachineAcctChange*",
    "*Invoke-AccessBinary*", "*Invoke-JSRatRegsvr*",
    "*Invoke-JSRatRundll*", "*Invoke-PoshRatHttps*",
    "*Invoke-PsGcatAgent*", "*Invoke-BackdoorLNK*",
    "*Invoke-PacketCapture*", "*Invoke-PowerShellTcpOneLine*", "*Invoke-PowerShellTcpOneLineBind*",
    "*Invoke-PowerShellUdp*", "*Invoke-PowerShellUdpOneLine*",
    "*Invoke-Vnc*", "*Invoke-LockWorkStation*",
    "*Invoke-EternalBlue*", "*Invoke-ShellcodeMSIL*",
    "*Invoke-MetasploitPayload*", "*Invoke-DowngradeAccount*",
    "*Invoke-MS16032*", "*Invoke-BypassUACTokenManipulation*",
    "*Invoke-SDCLTBypass*", "*Invoke-FodHelperBypass*",
    "*Invoke-EventVwrBypass*", "*Invoke-EnvBypass*", "*Invoke-PsUaCme*",
    "*Invoke-Tater*", "*Invoke-WScriptBypassUAC*",
    "*Invoke-Interceptor*", "*Invoke-PoshRatHttp*",
    "*Invoke-ExecCommandWMI*", "*Invoke-KillProcessWMI*",
    "*Invoke-CreateShareandExecute*", "*Invoke-RemoteScriptWithOutput*",
    "*Invoke-SchedJobManipulation*", "*Invoke-ServiceManipulation*",
    "*Invoke-PowerOptionsWMI*", "*Invoke-DirectoryListing*",
    "*Invoke-FileTransferOverWMI*", "*Invoke-WMImplant*",
    "*Invoke-WMIObfuscatedPSCommand*", "*Invoke-WMIDuplicateClass*",
    "*Invoke-WMIUpload*", "*Invoke-WMIRemoteExtract*", "*Invoke-winPEAS*") and

 not process.parent.executable :
              ("C:\\Program Files\\ASCI\\ActiveBatchV??\\bin\\abateagent.exe",
               "C:\\Program Files\\Windows Defender Advanced Threat Protection\\SenseIR.exe",
               "?:\\ProgramData\\Microsoft\\Windows Defender Advanced Threat Protection\\Platform\\*\\SenseIR.exe",
               "C:\\Program Files (x86)\\ossec-agent\\wazuh-agent.exe", 
               "C:\\Program Files (x86)\\Footprint\\Footprint Agent\\Footprint Agent.exe") and
 not (process.Ext.api.parameters.size == 63858 and process.Ext.api.parameters.buffer : "*$local:PowerSploitIndicators*") and
 not (process.Ext.api.parameters.size == 72914 and process.Ext.api.parameters.buffer : "*function Set-HookFunctionTabs*") and
 not (process.Ext.api.parameters.size == 4158 and process.Ext.api.parameters.content_name : "E:\\*\\Get-VaultEntry.ps1") and
 not (process.parent.executable : "C:\\Users\\*\\AppData\\Local\\Programs\\Microsoft VS Code\\Code.exe" and
      process.Ext.api.parameters.content_name : "E:\\SharePoint Sync\\*.ps1")
'''

min_endpoint_version = "8.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.001"
name = "PowerShell"
reference = "https://attack.mitre.org/techniques/T1059/001/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"

[internal]
min_endpoint_version = "8.16.0"