Malicious PowerShell Keywords

Status: test
Severity: medium
Log source: category ps_script, product windows
Author: Sean Metcalf (source), Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects keywords from well-known PowerShell exploitation frameworks

Known false positives

Depending on the scripts, this rule might require some initial tuning to fit the environment

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.001` Command and Scripting Interpreter: PowerShell

Telemetry coverage

Provider	Record / event type
PowerShell	Event ID 4104: Creating Scriptblock text (MessageNumber of MessageTotal).

Rule body

title: Malicious PowerShell Keywords
id: f62176f3-8128-4faa-bf6c-83261322e5eb
status: test
description: Detects keywords from well-known PowerShell exploitation frameworks
references:
    - https://adsecurity.org/?p=2921
author: Sean Metcalf (source), Florian Roth (Nextron Systems)
date: 2017-03-05
modified: 2023-06-20
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'AdjustTokenPrivileges'
            - 'IMAGE_NT_OPTIONAL_HDR64_MAGIC'
            # - 'LSA_UNICODE_STRING'
            - 'Metasploit'
            - 'Microsoft.Win32.UnsafeNativeMethods'
            - 'Mimikatz'
            - 'MiniDumpWriteDump'
            - 'PAGE_EXECUTE_READ'
            - 'ReadProcessMemory.Invoke'
            - 'SE_PRIVILEGE_ENABLED'
            - 'SECURITY_DELEGATION'
            - 'TOKEN_ADJUST_PRIVILEGES'
            - 'TOKEN_ALL_ACCESS'
            - 'TOKEN_ASSIGN_PRIMARY'
            - 'TOKEN_DUPLICATE'
            - 'TOKEN_ELEVATION'
            - 'TOKEN_IMPERSONATE'
            - 'TOKEN_INFORMATION_CLASS'
            - 'TOKEN_PRIVILEGES'
            - 'TOKEN_QUERY'
    condition: selection
falsepositives:
    - Depending on the scripts, this rule might require some initial tuning to fit the environment
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ScriptBlockText|contains:
        - 'AdjustTokenPrivileges'
        - 'IMAGE_NT_OPTIONAL_HDR64_MAGIC'
        - 'Metasploit'
        - 'Microsoft.Win32.UnsafeNativeMethods'
        - 'Mimikatz'
        - 'MiniDumpWriteDump'
        - 'PAGE_EXECUTE_READ'
        - 'ReadProcessMemory.Invoke'
        - 'SE_PRIVILEGE_ENABLED'
        - 'SECURITY_DELEGATION'
        - 'TOKEN_ADJUST_PRIVILEGES'
        - 'TOKEN_ALL_ACCESS'
        - 'TOKEN_ASSIGN_PRIMARY'
        - 'TOKEN_DUPLICATE'
        - 'TOKEN_ELEVATION'
        - 'TOKEN_IMPERSONATE'
        - 'TOKEN_INFORMATION_CLASS'
        - 'TOKEN_PRIVILEGES'
        - 'TOKEN_QUERY'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ScriptBlockText`	match	`AdjustTokenPrivileges` corpus 3 (sigma 3) `IMAGE_NT_OPTIONAL_HDR64_MAGIC` `Metasploit` `Microsoft.Win32.UnsafeNativeMethods` `Mimikatz` `MiniDumpWriteDump` corpus 2 (sigma 2) `PAGE_EXECUTE_READ` `ReadProcessMemory.Invoke` `SECURITY_DELEGATION` `SE_PRIVILEGE_ENABLED` `TOKEN_ADJUST_PRIVILEGES` `TOKEN_ALL_ACCESS` `TOKEN_ASSIGN_PRIMARY` `TOKEN_DUPLICATE` `TOKEN_ELEVATION` `TOKEN_IMPERSONATE` `TOKEN_INFORMATION_CLASS` `TOKEN_PRIVILEGES` `TOKEN_QUERY`	`field:"ScriptBlockText" kind:match`

Malicious PowerShell Keywords

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection

Indicators

Stage 0: `condition`

Stage 1: `selection`