Detection rules › Sigma

PowerShell Called from an Executable Version Mismatch

Status
test
Severity
high
Log source
product windows, category ps_classic_start
Author
Sean Metcalf (source), Florian Roth (Nextron Systems)
Source
github.com/SigmaHQ/sigma

Detects PowerShell called from an executable by the version mismatch method

MITRE ATT&CK coverage

Event coverage

Rule body yaml

title: PowerShell Called from an Executable Version Mismatch
id: c70e019b-1479-4b65-b0cc-cd0c6093a599
status: test
description: Detects PowerShell called from an executable by the version mismatch method
references:
    - https://adsecurity.org/?p=2921
author: Sean Metcalf (source), Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2023-10-27
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_classic_start
detection:
    selection_engine:
        Data|contains:
            - 'EngineVersion=2.'
            - 'EngineVersion=4.'
            - 'EngineVersion=5.'
    selection_host:
        Data|contains: 'HostVersion=3.'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_engine

selection_engine:
    Data|contains:
        - 'EngineVersion=2.'
        - 'EngineVersion=4.'
        - 'EngineVersion=5.'

Stage 2: selection_host

selection_host:
    Data|contains: 'HostVersion=3.'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Datamatch
  • EngineVersion=2. corpus 2 (sigma 2)
  • EngineVersion=4.
  • EngineVersion=5.
  • HostVersion=3.