Detection rules › Sigma
Powershell Inline Execution From A File
Detects inline execution of PowerShell code from a file
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Execution | T1059.001 Command and Scripting Interpreter: PowerShell |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: Powershell Inline Execution From A File
id: ee218c12-627a-4d27-9e30-d6fb2fe22ed2
status: test
description: Detects inline execution of PowerShell code from a file
references:
- https://speakerdeck.com/heirhabarov/hunting-for-powershell-abuse?slide=50
author: frack113
date: 2022-12-25
tags:
- attack.execution
- attack.t1059.001
logsource:
product: windows
category: process_creation
detection:
selection_exec:
CommandLine|contains:
- 'iex '
- 'Invoke-Expression '
- 'Invoke-Command '
- 'icm '
selection_read:
CommandLine|contains:
- 'cat '
- 'get-content '
- 'type '
selection_raw:
CommandLine|contains: ' -raw'
condition: all of selection_*
falsepositives:
- Unknown
level: medium
Stages and Predicates
Stage 0: condition
all of selection_*Stage 1: selection_exec
selection_exec:
CommandLine|contains:
- 'iex '
- 'Invoke-Expression '
- 'Invoke-Command '
- 'icm '
Stage 2: selection_read
selection_read:
CommandLine|contains:
- 'cat '
- 'get-content '
- 'type '
Stage 3: selection_raw
selection_raw:
CommandLine|contains: ' -raw'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|