rule_powershell_greyware_tool_keyword

YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'powershell' taken from the ThreatHunting-Keywords github project
rule rule_powershell_greyware_tool_keyword
{
    meta:
        description = "Detection patterns for the tool 'powershell' taken from the ThreatHunting-Keywords github project"
        author = "@mthcht"
        reference = "https://github.com/mthcht/ThreatHunting-Keywords"
        tool = "powershell"
        rule_category = "greyware_tool_keyword"

    strings:
                        $string1_powershell_greyware_tool_keyword = /\s\/c\sstart\s\/min\spowershell\s\-noprofile\s\-w\sH\s\-c\s.{0,1000}irw/ nocase ascii wide
                        $string2_powershell_greyware_tool_keyword = /\s\-ep\sBypass\s\-nop\sfunction\s.{0,1000}\[System\.Security\.Cryptography\.Aes\]\:\:Create\(\).{0,1000}\.CreateDecryptor\(\).{0,1000}\.TransformFinalBlock.{0,1000}\[System\.Text\.Encoding\]\:\:Utf8\.GetString/ nocase ascii wide
                        $string3_powershell_greyware_tool_keyword = /\s\-ep\sUnrestricted\s\-nop\sfunction\s.{0,1000}\[System\.Security\.Cryptography\.Aes\]\:\:Create\(\).{0,1000}\.CreateDecryptor\(\).{0,1000}\.TransformFinalBlock.{0,1000}\[System\.Text\.Encoding\]\:\:Utf8\.GetString/ nocase ascii wide
                        $string4_powershell_greyware_tool_keyword = " -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force" nocase ascii wide
                        $string5_powershell_greyware_tool_keyword = /\s\-NoExit\s\-Command\s\[Console\]\:\:OutputEncoding\=\[Text\.UTF8Encoding\]\:\:UTF8/ nocase ascii wide
                        $string6_powershell_greyware_tool_keyword = /\s\-NoP\s\-NonI\s\-W\sHidden\s\-Exec\sBypass\s\-Command\sNew\-Object\sSystem\.Net\.Sockets\.TCPClient/ nocase ascii wide
                        $string7_powershell_greyware_tool_keyword = " -NOP -WIND HIDDeN -eXeC BYPASS -NONI " nocase ascii wide
                        $string8_powershell_greyware_tool_keyword = /\s\-W\sHidden\s\-command\s.{0,1000}https\:\/\/.{0,1000}Invoke\-WebRequest.{0,1000}\;\siex\s\$/ nocase ascii wide
                        $string9_powershell_greyware_tool_keyword = /\s\-W\sHidden\s\-command\s.{0,1000}Invoke\-WebRequest.{0,1000}https\:\/\/.{0,1000}\;\siex\s\$/ nocase ascii wide
                        $string10_powershell_greyware_tool_keyword = /\s\-w\shidden\s\-ep\sbypass\s\-nop\s\-Command\s\\"iex\s\(\(New\-Object\sSystem\.Net\.WebClient\)\.DownloadString\(/ nocase ascii wide
                        $string11_powershell_greyware_tool_keyword = /\\"\[IO\.File\]\:\:WriteAllBytes\(\$.{0,1000}\,\[Convert\]\:\:FromBase64String\(\\"/ nocase ascii wide
                        $string12_powershell_greyware_tool_keyword = /\(\[System\.DirectoryServices\.ActiveDirectory\.Domain\]\:\:GetCurrentDomain\(\)\)\.GetAllTrustRelationships\(\)/ nocase ascii wide
                        $string13_powershell_greyware_tool_keyword = /\:\:CreateInstance\(\[type\]\:\:GetTypeFromCLSID\(\\"13709620\-C279\-11CE\-A49E\-444553540000/ nocase ascii wide
                        $string14_powershell_greyware_tool_keyword = /\:\:CreateInstance\(\[type\]\:\:GetTypeFromCLSID\(\\"33ABD590\-0400\-4FEF\-AF98\-5F5A8A99CFC3/ nocase ascii wide
                        $string15_powershell_greyware_tool_keyword = /\:\:CreateInstance\(\[type\]\:\:GetTypeFromCLSID\(\\"F935DC22\-1CF0\-11D0\-ADB9\-00C04FD58A0B\\"/ nocase ascii wide
                        $string16_powershell_greyware_tool_keyword = /\[IO\.Path\]\:\:Combine\(\$env\:TEMP\,\\"x\.exe\\"\)/ nocase ascii wide
                        $string17_powershell_greyware_tool_keyword = /\[System\.Environment\]\:\:GetEnvironmentVariable\(\'username\'\)/ nocase ascii wide
                        $string18_powershell_greyware_tool_keyword = /\\powershell\.exe.{0,1000}\s\+\=\shidden/ nocase ascii wide
                        $string19_powershell_greyware_tool_keyword = /\\powershell\.exe.{0,1000}\s\+\=hidden/ nocase ascii wide
                        $string20_powershell_greyware_tool_keyword = /\\powershell\.exe.{0,1000}\s\=\shidden/ nocase ascii wide
                        $string21_powershell_greyware_tool_keyword = /\\powershell\.exe.{0,1000}\s\=hidden/ nocase ascii wide
                        $string22_powershell_greyware_tool_keyword = /\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels.{0,1000}\s\-Name\s\\"DisableDevTunnelsInVisualStudio\\"\s\-Value\s0\s\-Type\sDword/ nocase ascii wide
                        $string23_powershell_greyware_tool_keyword = /\\Word\\Security\\"\s\-Name\s\\"AccessVBOM\\"\s\-Value\s1\s\-Type\sDword/ nocase ascii wide
                        $string24_powershell_greyware_tool_keyword = "Add-ADGroupMember -Identity  \"ESX Admins\"" nocase ascii wide
                        $string25_powershell_greyware_tool_keyword = /Add\-DnsClientDohServerAddress\s.{0,1000}\-ServerAddress\s/ nocase ascii wide
                        $string26_powershell_greyware_tool_keyword = /Add\-MpPreference\s\-ExclusionPath\s\@\(\$env\:UserProfile\,\s\$env\:ProgramData\)\s\-ExclusionExtension\s\'\.exe\'\s\-Force/ nocase ascii wide
                        $string27_powershell_greyware_tool_keyword = /Add\-MpPreference\s\-ExclusionPath\sC\:\\Video\,\sC\:\\install/ nocase ascii wide
                        $string28_powershell_greyware_tool_keyword = /Add\-MpPreference\s\-ExclusionProcess\s.{0,1000}\\Windows\\System32\\WindowsPowerShell\\v1\.0\\powershell\.exe/ nocase ascii wide
                        $string29_powershell_greyware_tool_keyword = /Add\-PswaAuthorizationRule\s\-UsernName\s\\.{0,1000}\s\-ComputerName\s\\.{0,1000}\s\-ConfigurationName\s\\/ nocase ascii wide
                        $string30_powershell_greyware_tool_keyword = /Add\-PswaAuthorizationRule.{0,1000}\-ComputerName\s/ nocase ascii wide
                        $string31_powershell_greyware_tool_keyword = /Add\-PswaAuthorizationRule.{0,1000}\-UserName\s/ nocase ascii wide
                        $string32_powershell_greyware_tool_keyword = /Add\-PswaAuthorizationRule.{0,1000}\-UserName\s/ nocase ascii wide
                        $string33_powershell_greyware_tool_keyword = /Add\-WindowsCapability\s\-Online\s\-Name\sOpenSSH\.Server/ nocase ascii wide
                        $string34_powershell_greyware_tool_keyword = "Add-WindowsFeature Hyper-V -IncludeManagementTools" nocase ascii wide
                        $string35_powershell_greyware_tool_keyword = "Backup-GPO -All -Path " nocase ascii wide
                        $string36_powershell_greyware_tool_keyword = "Clear-EventLog -LogName Security" nocase ascii wide
                        $string37_powershell_greyware_tool_keyword = "Clear-RecycleBin -Force -ErrorAction SilentlyContinue" nocase ascii wide
                        $string38_powershell_greyware_tool_keyword = /cmd\.exe\s\/c\sPowerShell\.exe\s\-Exec\sByPass\s\-Nol\s\-Enc\s/ nocase ascii wide
                        $string39_powershell_greyware_tool_keyword = "Connect-SocksServer -Server " nocase ascii wide
                        $string40_powershell_greyware_tool_keyword = /copy\-item\s.{0,1000}\\roaming\\microsoft\\windows\\start\smenu\\programs\\startup/ nocase ascii wide
                        $string41_powershell_greyware_tool_keyword = "dism  /online /enable-feature /featurename:IIS-WebServerRole /all" nocase ascii wide
                        $string42_powershell_greyware_tool_keyword = "dism  /online /enable-feature /featurename:WindowsPowerShellWebAccess /all" nocase ascii wide
                        $string43_powershell_greyware_tool_keyword = /dism\.exe.{0,1000}\/enable\-feature.{0,1000}WindowsPowerShellWebAccess\s/ nocase ascii wide
                        $string44_powershell_greyware_tool_keyword = "DisplayName -match \"Sophos Anti-Virus\"" nocase ascii wide
                        $string45_powershell_greyware_tool_keyword = "DisplayName -match \"Sophos AutoUpdate\"" nocase ascii wide
                        $string46_powershell_greyware_tool_keyword = "DisplayName -match \"Sophos Client Firewall\"" nocase ascii wide
                        $string47_powershell_greyware_tool_keyword = "DisplayName -match \"Sophos Endpoint Defense\"" nocase ascii wide
                        $string48_powershell_greyware_tool_keyword = "DisplayName -match \"Sophos Network Threat Protection\"" nocase ascii wide
                        $string49_powershell_greyware_tool_keyword = "DisplayName -match \"Sophos Remote Management System\"" nocase ascii wide
                        $string50_powershell_greyware_tool_keyword = "DisplayName -match \"Sophos System Protection\"" nocase ascii wide
                        $string51_powershell_greyware_tool_keyword = "enable-psremoting -force" nocase ascii wide
                        $string52_powershell_greyware_tool_keyword = "Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All" nocase ascii wide
                        $string53_powershell_greyware_tool_keyword = "Enable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -All" nocase ascii wide
                        $string54_powershell_greyware_tool_keyword = /Enable\-WindowsOptionalFeature\s\-Online\:\$true\s\-FeatureName\sMicrosoft\-Hyper\-V\s\-All\:\$true/ nocase ascii wide
                        $string55_powershell_greyware_tool_keyword = "Find-LocalAdminAccess -Verbose" nocase ascii wide
                        $string56_powershell_greyware_tool_keyword = /foreach\s\(\$.{0,1000}\s\{Test\-NetConnection\s\-Port\s/ nocase ascii wide
                        $string57_powershell_greyware_tool_keyword = "gci env:USERNAME" nocase ascii wide
                        $string58_powershell_greyware_tool_keyword = /gci\s\-h\sC\:\\pagefile\.sys/ nocase ascii wide
                        $string59_powershell_greyware_tool_keyword = /Get\-ADComputer\s\-Filter\s\{TrustedForDelegation\s\-eq\s\$True\}/ nocase ascii wide
                        $string60_powershell_greyware_tool_keyword = /Get\-ADGroup\s\-Filter\s.{0,1000}Name\s\-like\s.{0,1000}admin/ nocase ascii wide
                        $string61_powershell_greyware_tool_keyword = "Get-ADGroupMember Administrators -Recursive" nocase ascii wide
                        $string62_powershell_greyware_tool_keyword = "Get-ADGroupMember -Identity \"Domain Admins\"" nocase ascii wide
                        $string63_powershell_greyware_tool_keyword = /Get\-ADObject\s\-Filter\s\{msDS\-AllowedToDelegateTo\s.{0,1000}\s\-Properties\smsDS\-AllowedToDelegateTo/ nocase ascii wide
                        $string64_powershell_greyware_tool_keyword = /Get\-ADObject\s\-SearchBase\s.{0,1000}CN\=Shadow\sPrincipal\sConfiguration.{0,1000}CN\=Services.{0,1000}\s\(Get\-ADRootDSE\)\.configurationNamingContext\)\s\|\sselect\s.{0,1000}msDS\-ShadowPrincipalSid/ nocase ascii wide
                        $string65_powershell_greyware_tool_keyword = /Get\-ADUser\s\-Filter\s\{DoesNotRequirePreAuth\s\-eq\s\$True\}\s\-Properties\sDoesNotRequirePreAuth/ nocase ascii wide
                        $string66_powershell_greyware_tool_keyword = /Get\-ADUser\s\-Filter\s\{TrustedForDelegation\s\-eq\s\$True\}/ nocase ascii wide
                        $string67_powershell_greyware_tool_keyword = "Get-AppLockerPolicy -Effective " nocase ascii wide
                        $string68_powershell_greyware_tool_keyword = /Get\-ChildItem\s\-Hidden\sC\:\\Users\\.{0,1000}\\AppData\\Local\\Microsoft\\Credentials\\/ nocase ascii wide
                        $string69_powershell_greyware_tool_keyword = /Get\-ChildItem\s\-Hidden\sC\:\\Users\\.{0,1000}\\AppData\\Roaming\\Microsoft\\Credentials\\/ nocase ascii wide
                        $string70_powershell_greyware_tool_keyword = /Get\-DhcpServerv4Scope\s\|\sSet\-DhcpServerv4OptionValue\s\-DnsServer\s/ nocase ascii wide
                        $string71_powershell_greyware_tool_keyword = "Get-DomainComputer -TrustedToAuth" nocase ascii wide
                        $string72_powershell_greyware_tool_keyword = "Get-DomainUser -KerberosPreuthNotRequired -Verbose" nocase ascii wide
                        $string73_powershell_greyware_tool_keyword = "Get-GPO -All" nocase ascii wide
                        $string74_powershell_greyware_tool_keyword = "Get-LoggedonLocal -ComputerName " nocase ascii wide
                        $string75_powershell_greyware_tool_keyword = "Get-MpComputerStatus" nocase ascii wide
                        $string76_powershell_greyware_tool_keyword = /Get\-MpPreference\s\|\sSelect\-Object\s\-ExpandProperty\sExclusionPath/ nocase ascii wide
                        $string77_powershell_greyware_tool_keyword = "Get-NetGroup -FullData" nocase ascii wide
                        $string78_powershell_greyware_tool_keyword = /Get\-NetGroupMember\s\-GroupName\s.{0,1000}DNSAdmins/ nocase ascii wide
                        $string79_powershell_greyware_tool_keyword = "Get-NetUser -SPN" nocase ascii wide
                        $string80_powershell_greyware_tool_keyword = /Get\-WmiObject\sWin32_ShadowCopy\s\|\sRemove\-WmiObject/ nocase ascii wide
                        $string81_powershell_greyware_tool_keyword = /HostVersion\=2\.0.{0,1000}EngineVersion\=2\.0/ nocase ascii wide
                        $string82_powershell_greyware_tool_keyword = /IEX\s\(\[System\.Text\.Encoding\]\:\:UTF8\.GetString\(\[System\.Convert\]\:\:FromBase64String\(/ nocase ascii wide
                        $string83_powershell_greyware_tool_keyword = /IEX\(New\-Object\sSystem\.Net\.WebClient\)\.DownloadString\(\\"https\:\/\/raw\.githubusercontent\.com\// nocase ascii wide
                        $string84_powershell_greyware_tool_keyword = "Install-PswaWebApplication -UseTestCertificate" nocase ascii wide
                        $string85_powershell_greyware_tool_keyword = "Install-PswaWebApplication" nocase ascii wide
                        $string86_powershell_greyware_tool_keyword = "Install-WindowsFeature -Name Web-Server -IncludeManagementTools" nocase ascii wide
                        $string87_powershell_greyware_tool_keyword = "Install-WindowsFeature WindowsPowerShellWebAccess" nocase ascii wide
                        $string88_powershell_greyware_tool_keyword = "Invoke-EnumerateLocalAdmin -Verbose" nocase ascii wide
                        $string89_powershell_greyware_tool_keyword = /invoke\-expression\(\[System\.Text\.Encoding\]\:\:UTF8\.GetString\(\[System\.Convert\]\:\:FromBase64String\(/ nocase ascii wide
                        $string90_powershell_greyware_tool_keyword = "Invoke-UserHunter -CheckAccess" nocase ascii wide
                        $string91_powershell_greyware_tool_keyword = /Invoke\-WebRequest\sifconfig\.me\/ip.{0,1000}Content\.Trim\(\)/ nocase ascii wide
                        $string92_powershell_greyware_tool_keyword = "ls env:USERNAME" nocase ascii wide
                        $string93_powershell_greyware_tool_keyword = "New-ADGroup -Name \"ESX Admins\"" nocase ascii wide
                        $string94_powershell_greyware_tool_keyword = /New\-ItemProperty\s\-Path\s\\"HKLM\:\\Software\\Microsoft\\Windows\sNT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist\\"\s\-Name\s.{0,1000}\s\-Value\s0\s\-PropertyType\sDword/ nocase ascii wide
                        $string95_powershell_greyware_tool_keyword = /New\-ItemProperty\s\-Path\s\\"HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels\\"\s\-Name\s\\"DisableDevTunnelsInVisualStudio\\"\s\-PropertyType\sDWORD\s\-Value\s0/ nocase ascii wide
                        $string96_powershell_greyware_tool_keyword = /New\-ItemProperty\s\-Path\s\\"HKLM\:\\SOFTWARE\\Policies\\Microsoft\\Windows\sDefender\\"\s\-Name\sDisableAntiSpyware\s\-Value\s1\s\-PropertyType\sDWORD\s\-Force\s/ nocase ascii wide
                        $string97_powershell_greyware_tool_keyword = /New\-NetFirewallRule\s.{0,1000}\s\-Enabled\sTrue\s\-Direction\sInbound\s\-Protocol\sTCP\s\-Action\sAllow\s\-LocalPort\s22/ nocase ascii wide
                        $string98_powershell_greyware_tool_keyword = /New\-Object\sSystem\.Net\.Sockets\.TCPClient\(.{0,1000}\$stream\s\=\s\$client\.GetStream\(\).{0,1000}\[byte\[\]\]\$bytes\s\=\s0\.\.65535/ nocase ascii wide
                        $string99_powershell_greyware_tool_keyword = /powershell\s\?encodedcommand\s\$env\:PSExecutionPolicyPreference\=\\"bypass\\"/ nocase ascii wide
                        $string100_powershell_greyware_tool_keyword = "powershell -c \"Clear-History\"" nocase ascii wide
                        $string101_powershell_greyware_tool_keyword = /powershell\s\-c\s.{0,1000}\\windows\\system32\\inetsrv\\appcmd\.exe\slist\sapppool\s\/\@t\:/ nocase ascii wide
                        $string102_powershell_greyware_tool_keyword = "powershell -c clear" nocase ascii wide
                        $string103_powershell_greyware_tool_keyword = /powershell\sNew\-ItemProperty\s\-Path\s.{0,1000}HKLM\:\\SOFTWARE\\Policies\\Microsoft\\Windows\sDefender.{0,1000}\s\-Name\sDisableAntiSpyware\s\-Value\s1\s\-PropertyType\sDWORD\s\-Force/ nocase ascii wide
                        $string104_powershell_greyware_tool_keyword = "powershell Uninstall-WindowsFeature -Name Windows-Defender" nocase ascii wide
                        $string105_powershell_greyware_tool_keyword = "PowerShell -Version 2 -Command " nocase ascii wide
                        $string106_powershell_greyware_tool_keyword = "powershell -Version 2" nocase ascii wide
                        $string107_powershell_greyware_tool_keyword = /powershell.{0,1000}Uninstall\-WindowsFeature\s\-Name\sWindows\-Defender\-GUI/ nocase ascii wide
                        $string108_powershell_greyware_tool_keyword = /Powershell\.exe\s\s\-windowstyle\shidden\s\-nop\s\-ExecutionPolicy\sBypass\s\s\-Commmand\s.{0,1000}C\:\\Users\\.{0,1000}\\AppData\\Roaming\\/ nocase ascii wide
                        $string109_powershell_greyware_tool_keyword = /powershell\.exe\scurl\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
                        $string110_powershell_greyware_tool_keyword = /powershell\.exe\s\-exec\sbypass\s\-noni\s\-nop\s\-w\s1\s\-C/ nocase ascii wide
                        $string111_powershell_greyware_tool_keyword = /powershell\.exe\s\-exec\sbypass\s\-noni\s\-nop\s\-w\s1\s\-C.{0,1000}invoke_obfuscation/ nocase ascii wide
                        $string112_powershell_greyware_tool_keyword = /powershell\.exe\sInvoke\-WebRequest\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
                        $string113_powershell_greyware_tool_keyword = /powershell\.exe\siwr\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
                        $string114_powershell_greyware_tool_keyword = /powershell\.exe\s\-noni\s\-nop\s\-w\s1\s\-enc\s/ nocase ascii wide
                        $string115_powershell_greyware_tool_keyword = /powershell\.exe\s\-NoP\s\-NoL\s\-sta\s\-NonI\s\-W\sHidden\s\-Exec\sBypass\s\-Enc\s/ nocase ascii wide
                        $string116_powershell_greyware_tool_keyword = /powershell\.exe\s\-nop\s\-w\shidden\s\-c\s\\"IEX\s\(\(new\-object\snet\.webclient\)\.downloadstring\(\'http\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
                        $string117_powershell_greyware_tool_keyword = /PowerShell\.exe\s\-Version\s2\s\-Command\s/ nocase ascii wide
                        $string118_powershell_greyware_tool_keyword = /powershell\.exe\s\-Version\s2/ nocase ascii wide
                        $string119_powershell_greyware_tool_keyword = /powershell\.exe\swget\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
                        $string120_powershell_greyware_tool_keyword = /powershell\.exe\\"\s\-Version\s2/ nocase ascii wide
                        $string121_powershell_greyware_tool_keyword = /reg\sdelete\s.{0,1000}\s\/v\sMRUList\s\/f/ nocase ascii wide
                        $string122_powershell_greyware_tool_keyword = /Remove\-Item\s\-LiteralPath\s\\"C\:\\Program\sFiles\s\(x86\)\\Sophos\\"\s\-Force\s\-Recurse/ nocase ascii wide
                        $string123_powershell_greyware_tool_keyword = /Remove\-Item\s\-LiteralPath\s\\"C\:\\Program\sFiles\\Sophos\\"\s\-Force\s\-Recurse/ nocase ascii wide
                        $string124_powershell_greyware_tool_keyword = /Remove\-Item\s\-LiteralPath\s\\"C\:\\Program\sFiles\\Sophos.{0,1000}\\"\s\-Force\s\-Recurse/ nocase ascii wide
                        $string125_powershell_greyware_tool_keyword = /Remove\-Item\s\-LiteralPath\s\\"C\:\\ProgramData\\Sophos\\"\s\-Force\s\-Recurse/ nocase ascii wide
                        $string126_powershell_greyware_tool_keyword = /Remove\-ItemProperty\s\-Path\s\\"HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels\\"\s\-Name\s\\"DisableDevTunnelsInVisualStudio\\"/ nocase ascii wide
                        $string127_powershell_greyware_tool_keyword = /Remove\-ItemProperty\s\-Path.{0,1000}\s\-Name\sMRUList\s/ nocase ascii wide
                        $string128_powershell_greyware_tool_keyword = /Remove\-ItemProperty.{0,1000}HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels.{0,1000}DisableDevTunnelsInVisualStudio/ nocase ascii wide
                        $string129_powershell_greyware_tool_keyword = /root\/SecurityCenter2.{0,1000}\s\-ClassName\sAntiVirusProduct/ nocase ascii wide
                        $string130_powershell_greyware_tool_keyword = /S\`eT\-It\`em\s\(\s\'V\'\+\'aR\'\s\+\s\s\'IA\'\s\+\s\(\'blE\:1\'\+\'q2\'\)/ nocase ascii wide
                        $string131_powershell_greyware_tool_keyword = /Set\-ADObject\s\-SamAccountName\s.{0,1000}\s\-PropertyName\sscriptpath\s\-PropertyValue\s.{0,1000}\\.{0,1000}\.exe/ nocase ascii wide
                        $string132_powershell_greyware_tool_keyword = "Set-Clipboard -Value ' '" nocase ascii wide
                        $string133_powershell_greyware_tool_keyword = "Set-Clipboard -Value ''" nocase ascii wide
                        $string134_powershell_greyware_tool_keyword = /Set\-ItemProperty.{0,1000}HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels.{0,1000}DisableDevTunnelsInVisualStudio.{0,1000}0/ nocase ascii wide
                        $string135_powershell_greyware_tool_keyword = /Set\-MPPreference\s\-DisableIntrusionPreventionSystem\s\$true/ nocase ascii wide
                        $string136_powershell_greyware_tool_keyword = /Set\-MpPreference\s\-DisableIOAVProtection\s\$true/ nocase ascii wide
                        $string137_powershell_greyware_tool_keyword = /Set\-MpPreference\s\-DisableRealtimeMonitoring\s\$true/ nocase ascii wide
                        $string138_powershell_greyware_tool_keyword = "Set-MpPreference -DisableScriptScanning 1 " nocase ascii wide
                        $string139_powershell_greyware_tool_keyword = "Set-MpPreference -ExclusionExtension exe" nocase ascii wide
                        $string140_powershell_greyware_tool_keyword = "Set-Service -Name sshd -StartupType 'Automatic'" nocase ascii wide
                        $string141_powershell_greyware_tool_keyword = "Start-Service sshd" nocase ascii wide
                        $string142_powershell_greyware_tool_keyword = "Stop-Process -Name \"Sophos " nocase ascii wide
                        $string143_powershell_greyware_tool_keyword = "Stop-Process -Name \"SQL Backups\"" nocase ascii wide
                        $string144_powershell_greyware_tool_keyword = "Stop-Process -Name \"SQLsafe Backup Service\"" nocase ascii wide
                        $string145_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\s\\"storagecraft\simagemanager.{0,1000}\\"/ nocase ascii wide
                        $string146_powershell_greyware_tool_keyword = "Stop-Process -Name \"Symantec System Recovery\"" nocase ascii wide
                        $string147_powershell_greyware_tool_keyword = "Stop-Process -Name \"Veeam Backup Catalog Data Service\"" nocase ascii wide
                        $string148_powershell_greyware_tool_keyword = "Stop-Process -Name \"Zoolz 2 Service\"" nocase ascii wide
                        $string149_powershell_greyware_tool_keyword = "Stop-Process -Name acronisagent" nocase ascii wide
                        $string150_powershell_greyware_tool_keyword = "Stop-Process -Name AcronisAgent" nocase ascii wide
                        $string151_powershell_greyware_tool_keyword = "Stop-Process -Name acrsch2svc" nocase ascii wide
                        $string152_powershell_greyware_tool_keyword = "Stop-Process -Name AcrSch2Svc" nocase ascii wide
                        $string153_powershell_greyware_tool_keyword = "Stop-Process -Name agntsvc" nocase ascii wide
                        $string154_powershell_greyware_tool_keyword = "Stop-Process -Name Antivirus" nocase ascii wide
                        $string155_powershell_greyware_tool_keyword = "Stop-Process -Name ARSM /y" nocase ascii wide
                        $string156_powershell_greyware_tool_keyword = "Stop-Process -Name arsm" nocase ascii wide
                        $string157_powershell_greyware_tool_keyword = "Stop-Process -Name AVP" nocase ascii wide
                        $string158_powershell_greyware_tool_keyword = "Stop-Process -Name backp" nocase ascii wide
                        $string159_powershell_greyware_tool_keyword = "Stop-Process -Name backup" nocase ascii wide
                        $string160_powershell_greyware_tool_keyword = "Stop-Process -Name BackupExec" nocase ascii wide
                        $string161_powershell_greyware_tool_keyword = "Stop-Process -Name BackupExecAgent" nocase ascii wide
                        $string162_powershell_greyware_tool_keyword = "Stop-Process -Name bedbg /y" nocase ascii wide
                        $string163_powershell_greyware_tool_keyword = "Stop-Process -Name cbservi" nocase ascii wide
                        $string164_powershell_greyware_tool_keyword = "Stop-Process -Name cbvscserv" nocase ascii wide
                        $string165_powershell_greyware_tool_keyword = "Stop-Process -Name DCAgent" nocase ascii wide
                        $string166_powershell_greyware_tool_keyword = "Stop-Process -Name EhttpSrv" nocase ascii wide
                        $string167_powershell_greyware_tool_keyword = "Stop-Process -Name ekrn" nocase ascii wide
                        $string168_powershell_greyware_tool_keyword = "Stop-Process -Name EPSecurityService" nocase ascii wide
                        $string169_powershell_greyware_tool_keyword = "Stop-Process -Name EPUpdateService" nocase ascii wide
                        $string170_powershell_greyware_tool_keyword = "Stop-Process -Name EsgShKernel" nocase ascii wide
                        $string171_powershell_greyware_tool_keyword = "Stop-Process -Name ESHASRV" nocase ascii wide
                        $string172_powershell_greyware_tool_keyword = "Stop-Process -Name FA_Scheduler" nocase ascii wide
                        $string173_powershell_greyware_tool_keyword = "Stop-Process -Name IMAP4Svc" nocase ascii wide
                        $string174_powershell_greyware_tool_keyword = "Stop-Process -Name KAVFS" nocase ascii wide
                        $string175_powershell_greyware_tool_keyword = "Stop-Process -Name KAVFSGT" nocase ascii wide
                        $string176_powershell_greyware_tool_keyword = "Stop-Process -Name kavfsslp" nocase ascii wide
                        $string177_powershell_greyware_tool_keyword = "Stop-Process -Name klnagent" nocase ascii wide
                        $string178_powershell_greyware_tool_keyword = "Stop-Process -Name macmnsvc" nocase ascii wide
                        $string179_powershell_greyware_tool_keyword = "Stop-Process -Name masvc" nocase ascii wide
                        $string180_powershell_greyware_tool_keyword = "Stop-Process -Name MBAMService" nocase ascii wide
                        $string181_powershell_greyware_tool_keyword = "Stop-Process -Name MBEndpointAgent" nocase ascii wide
                        $string182_powershell_greyware_tool_keyword = "Stop-Process -Name McAfeeEngineService" nocase ascii wide
                        $string183_powershell_greyware_tool_keyword = "Stop-Process -Name McAfeeFramework" nocase ascii wide
                        $string184_powershell_greyware_tool_keyword = "Stop-Process -Name McAfeeFrameworkMcAfeeFramework" nocase ascii wide
                        $string185_powershell_greyware_tool_keyword = "Stop-Process -Name McShield" nocase ascii wide
                        $string186_powershell_greyware_tool_keyword = "Stop-Process -Name mfefire" nocase ascii wide
                        $string187_powershell_greyware_tool_keyword = "Stop-Process -Name mfemms" nocase ascii wide
                        $string188_powershell_greyware_tool_keyword = "Stop-Process -Name mfevtp" nocase ascii wide
                        $string189_powershell_greyware_tool_keyword = "Stop-Process -Name mozyprobackup" nocase ascii wide
                        $string190_powershell_greyware_tool_keyword = "Stop-Process -Name MsDtsServer" nocase ascii wide
                        $string191_powershell_greyware_tool_keyword = "Stop-Process -Name MsDtsServer100" nocase ascii wide
                        $string192_powershell_greyware_tool_keyword = "Stop-Process -Name MsDtsServer110" nocase ascii wide
                        $string193_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\smsftesql\$PROD/ nocase ascii wide
                        $string194_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSOLAP\$SQL_2008/ nocase ascii wide
                        $string195_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSOLAP\$SYSTEM_BGC/ nocase ascii wide
                        $string196_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSOLAP\$TPS/ nocase ascii wide
                        $string197_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSOLAP\$TPSAMA/ nocase ascii wide
                        $string198_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$BKUPEXEC/ nocase ascii wide
                        $string199_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$ECWDB2/ nocase ascii wide
                        $string200_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$PRACTICEMGT/ nocase ascii wide
                        $string201_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$PRACTTICEBGC/ nocase ascii wide
                        $string202_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$PROD/ nocase ascii wide
                        $string203_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$PROFXENGAGEMENT/ nocase ascii wide
                        $string204_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$SBSMONITORING/ nocase ascii wide
                        $string205_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$SHAREPOINT/ nocase ascii wide
                        $string206_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$SOPHOS/ nocase ascii wide
                        $string207_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$SQL_2008/ nocase ascii wide
                        $string208_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$SQLEXPRESS/ nocase ascii wide
                        $string209_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$SYSTEM_BGC/ nocase ascii wide
                        $string210_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$TPS/ nocase ascii wide
                        $string211_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$TPSAMA/ nocase ascii wide
                        $string212_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$VEEAMSQL/ nocase ascii wide
                        $string213_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sMSSQL\$VEEAMSQL/ nocase ascii wide
                        $string214_powershell_greyware_tool_keyword = "Stop-Process -Name sacsvr" nocase ascii wide
                        $string215_powershell_greyware_tool_keyword = "Stop-Process -Name SAVAdminService" nocase ascii wide
                        $string216_powershell_greyware_tool_keyword = "Stop-Process -Name SAVService" nocase ascii wide
                        $string217_powershell_greyware_tool_keyword = "Stop-Process -Name shadowprotectsvc" nocase ascii wide
                        $string218_powershell_greyware_tool_keyword = "Stop-Process -Name ShMonitor" nocase ascii wide
                        $string219_powershell_greyware_tool_keyword = "Stop-Process -Name Smcinst" nocase ascii wide
                        $string220_powershell_greyware_tool_keyword = "Stop-Process -Name SmcService" nocase ascii wide
                        $string221_powershell_greyware_tool_keyword = "Stop-Process -Name sms_site_sql_backup" nocase ascii wide
                        $string222_powershell_greyware_tool_keyword = "Stop-Process -Name SntpService" nocase ascii wide
                        $string223_powershell_greyware_tool_keyword = "Stop-Process -Name sophossps" nocase ascii wide
                        $string224_powershell_greyware_tool_keyword = "Stop-Process -Name spxservice" nocase ascii wide
                        $string225_powershell_greyware_tool_keyword = "Stop-Process -Name sqbcoreservice" nocase ascii wide
                        $string226_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sSQLAgent\$SOPH/ nocase ascii wide
                        $string227_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sSQLAgent\$VEEAMSQL/ nocase ascii wide
                        $string228_powershell_greyware_tool_keyword = /Stop\-Process\s\-Name\sSQLAgent\$VEEAMSQL/ nocase ascii wide
                        $string229_powershell_greyware_tool_keyword = "Stop-Process -Name stc_endpt_svc" nocase ascii wide
                        $string230_powershell_greyware_tool_keyword = "Stop-Process -Name stop SepMasterService" nocase ascii wide
                        $string231_powershell_greyware_tool_keyword = "Stop-Process -Name svcGenericHost" nocase ascii wide
                        $string232_powershell_greyware_tool_keyword = "Stop-Process -Name swi_filter" nocase ascii wide
                        $string233_powershell_greyware_tool_keyword = "Stop-Process -Name swi_service" nocase ascii wide
                        $string234_powershell_greyware_tool_keyword = "Stop-Process -Name swi_update" nocase ascii wide
                        $string235_powershell_greyware_tool_keyword = "Stop-Process -Name swi_update_64" nocase ascii wide
                        $string236_powershell_greyware_tool_keyword = "Stop-Process -Name TmCCSF" nocase ascii wide
                        $string237_powershell_greyware_tool_keyword = "Stop-Process -Name tmlisten" nocase ascii wide
                        $string238_powershell_greyware_tool_keyword = "Stop-Process -Name TrueKey" nocase ascii wide
                        $string239_powershell_greyware_tool_keyword = "Stop-Process -Name TrueKeyScheduler" nocase ascii wide
                        $string240_powershell_greyware_tool_keyword = "Stop-Process -Name TrueKeyServiceHel" nocase ascii wide
                        $string241_powershell_greyware_tool_keyword = "Stop-Process -Name vapiendpoint" nocase ascii wide
                        $string242_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamBackupSvc" nocase ascii wide
                        $string243_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamBrokerSvc " nocase ascii wide
                        $string244_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamCatalogSvc" nocase ascii wide
                        $string245_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamCloudSvc" nocase ascii wide
                        $string246_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamDeploymentService" nocase ascii wide
                        $string247_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamDeploySvc" nocase ascii wide
                        $string248_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamDeploySvc" nocase ascii wide
                        $string249_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamEnterpriseManagerSvc" nocase ascii wide
                        $string250_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamHvIntegrationSvc" nocase ascii wide
                        $string251_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamMountSvc" nocase ascii wide
                        $string252_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamNFSSvc" nocase ascii wide
                        $string253_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamRESTSvc" nocase ascii wide
                        $string254_powershell_greyware_tool_keyword = "Stop-Process -Name VeeamTransportSvc" nocase ascii wide
                        $string255_powershell_greyware_tool_keyword = "Stop-Process -Name vsnapvss" nocase ascii wide
                        $string256_powershell_greyware_tool_keyword = "Stop-Process -Name vssvc" nocase ascii wide
                        $string257_powershell_greyware_tool_keyword = "Stop-Process -Name wbengine" nocase ascii wide
                        $string258_powershell_greyware_tool_keyword = "Stop-Process -Name wbengine" nocase ascii wide
                        $string259_powershell_greyware_tool_keyword = "Stop-Process -Name WRSVC" nocase ascii wide
                        $string260_powershell_greyware_tool_keyword = /System\.IO\.MemoryStream\(\,\[System\.Convert\]\:\:FromBase64String\(/ nocase ascii wide
                        $string261_powershell_greyware_tool_keyword = "Uninstall-WindowsFeature -Name Windows-Defender" nocase ascii wide

    condition:
        any of them
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

dd1c2531-c7f9-4bd4-bf4a-9778ae76ae3e
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
