powershell
YARA detection rule by @mthcht · NOASSERTION
Detection patterns for the tool 'powershell' taken from the ThreatHunting-Keywords github project
rule powershell
{
meta:
description = "Detection patterns for the tool 'powershell' taken from the ThreatHunting-Keywords github project"
author = "@mthcht"
reference = "https://github.com/mthcht/ThreatHunting-Keywords"
tool = "powershell"
rule_category = "greyware_tool_keyword"
strings:
$string1 = /\s\/c\sstart\s\/min\spowershell\s\-noprofile\s\-w\sH\s\-c\s.{0,1000}irw/ nocase ascii wide
$string2 = /\s\-ep\sBypass\s\-nop\sfunction\s.{0,1000}\[System\.Security\.Cryptography\.Aes\]\:\:Create\(\).{0,1000}\.CreateDecryptor\(\).{0,1000}\.TransformFinalBlock.{0,1000}\[System\.Text\.Encoding\]\:\:Utf8\.GetString/ nocase ascii wide
$string3 = /\s\-ep\sUnrestricted\s\-nop\sfunction\s.{0,1000}\[System\.Security\.Cryptography\.Aes\]\:\:Create\(\).{0,1000}\.CreateDecryptor\(\).{0,1000}\.TransformFinalBlock.{0,1000}\[System\.Text\.Encoding\]\:\:Utf8\.GetString/ nocase ascii wide
$string4 = " -Name DisableAntiSpyware -Value 1 -PropertyType DWORD -Force" nocase ascii wide
$string5 = /\s\-NoExit\s\-Command\s\[Console\]\:\:OutputEncoding\=\[Text\.UTF8Encoding\]\:\:UTF8/ nocase ascii wide
$string6 = /\s\-NoP\s\-NonI\s\-W\sHidden\s\-Exec\sBypass\s\-Command\sNew\-Object\sSystem\.Net\.Sockets\.TCPClient/ nocase ascii wide
$string7 = " -NOP -WIND HIDDeN -eXeC BYPASS -NONI " nocase ascii wide
$string8 = /\s\-W\sHidden\s\-command\s.{0,1000}https\:\/\/.{0,1000}Invoke\-WebRequest.{0,1000}\;\siex\s\$/ nocase ascii wide
$string9 = /\s\-W\sHidden\s\-command\s.{0,1000}Invoke\-WebRequest.{0,1000}https\:\/\/.{0,1000}\;\siex\s\$/ nocase ascii wide
$string10 = /\s\-w\shidden\s\-ep\sbypass\s\-nop\s\-Command\s\\"iex\s\(\(New\-Object\sSystem\.Net\.WebClient\)\.DownloadString\(/ nocase ascii wide
$string11 = /\\"\[IO\.File\]\:\:WriteAllBytes\(\$.{0,1000}\,\[Convert\]\:\:FromBase64String\(\\"/ nocase ascii wide
$string12 = /\(\[System\.DirectoryServices\.ActiveDirectory\.Domain\]\:\:GetCurrentDomain\(\)\)\.GetAllTrustRelationships\(\)/ nocase ascii wide
$string13 = /\:\:CreateInstance\(\[type\]\:\:GetTypeFromCLSID\(\\"13709620\-C279\-11CE\-A49E\-444553540000/ nocase ascii wide
$string14 = /\:\:CreateInstance\(\[type\]\:\:GetTypeFromCLSID\(\\"33ABD590\-0400\-4FEF\-AF98\-5F5A8A99CFC3/ nocase ascii wide
$string15 = /\:\:CreateInstance\(\[type\]\:\:GetTypeFromCLSID\(\\"F935DC22\-1CF0\-11D0\-ADB9\-00C04FD58A0B\\"/ nocase ascii wide
$string16 = /\[IO\.Path\]\:\:Combine\(\$env\:TEMP\,\\"x\.exe\\"\)/ nocase ascii wide
$string17 = /\[System\.Environment\]\:\:GetEnvironmentVariable\(\'username\'\)/ nocase ascii wide
$string18 = /\\powershell\.exe.{0,1000}\s\+\=\shidden/ nocase ascii wide
$string19 = /\\powershell\.exe.{0,1000}\s\+\=hidden/ nocase ascii wide
$string20 = /\\powershell\.exe.{0,1000}\s\=\shidden/ nocase ascii wide
$string21 = /\\powershell\.exe.{0,1000}\s\=hidden/ nocase ascii wide
$string22 = /\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels.{0,1000}\s\-Name\s\\"DisableDevTunnelsInVisualStudio\\"\s\-Value\s0\s\-Type\sDword/ nocase ascii wide
$string23 = /\\Word\\Security\\"\s\-Name\s\\"AccessVBOM\\"\s\-Value\s1\s\-Type\sDword/ nocase ascii wide
$string24 = "Add-ADGroupMember -Identity \"ESX Admins\"" nocase ascii wide
$string25 = /Add\-DnsClientDohServerAddress\s.{0,1000}\-ServerAddress\s/ nocase ascii wide
$string26 = /Add\-MpPreference\s\-ExclusionPath\s\@\(\$env\:UserProfile\,\s\$env\:ProgramData\)\s\-ExclusionExtension\s\'\.exe\'\s\-Force/ nocase ascii wide
$string27 = /Add\-MpPreference\s\-ExclusionPath\sC\:\\Video\,\sC\:\\install/ nocase ascii wide
$string28 = /Add\-MpPreference\s\-ExclusionProcess\s.{0,1000}\\Windows\\System32\\WindowsPowerShell\\v1\.0\\powershell\.exe/ nocase ascii wide
$string29 = /Add\-PswaAuthorizationRule\s\-UsernName\s\\.{0,1000}\s\-ComputerName\s\\.{0,1000}\s\-ConfigurationName\s\\/ nocase ascii wide
$string30 = /Add\-PswaAuthorizationRule.{0,1000}\-ComputerName\s/ nocase ascii wide
$string31 = /Add\-PswaAuthorizationRule.{0,1000}\-UserName\s/ nocase ascii wide
$string32 = /Add\-PswaAuthorizationRule.{0,1000}\-UserName\s/ nocase ascii wide
$string33 = /Add\-WindowsCapability\s\-Online\s\-Name\sOpenSSH\.Server/ nocase ascii wide
$string34 = "Add-WindowsFeature Hyper-V -IncludeManagementTools" nocase ascii wide
$string35 = "Backup-GPO -All -Path " nocase ascii wide
$string36 = "Clear-EventLog -LogName Security" nocase ascii wide
$string37 = "Clear-RecycleBin -Force -ErrorAction SilentlyContinue" nocase ascii wide
$string38 = /cmd\.exe\s\/c\sPowerShell\.exe\s\-Exec\sByPass\s\-Nol\s\-Enc\s/ nocase ascii wide
$string39 = "Connect-SocksServer -Server " nocase ascii wide
$string40 = /copy\-item\s.{0,1000}\\roaming\\microsoft\\windows\\start\smenu\\programs\\startup/ nocase ascii wide
$string41 = "dism /online /enable-feature /featurename:IIS-WebServerRole /all" nocase ascii wide
$string42 = "dism /online /enable-feature /featurename:WindowsPowerShellWebAccess /all" nocase ascii wide
$string43 = /dism\.exe.{0,1000}\/enable\-feature.{0,1000}WindowsPowerShellWebAccess\s/ nocase ascii wide
$string44 = "DisplayName -match \"Sophos Anti-Virus\"" nocase ascii wide
$string45 = "DisplayName -match \"Sophos AutoUpdate\"" nocase ascii wide
$string46 = "DisplayName -match \"Sophos Client Firewall\"" nocase ascii wide
$string47 = "DisplayName -match \"Sophos Endpoint Defense\"" nocase ascii wide
$string48 = "DisplayName -match \"Sophos Network Threat Protection\"" nocase ascii wide
$string49 = "DisplayName -match \"Sophos Remote Management System\"" nocase ascii wide
$string50 = "DisplayName -match \"Sophos System Protection\"" nocase ascii wide
$string51 = "enable-psremoting -force" nocase ascii wide
$string52 = "Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All" nocase ascii wide
$string53 = "Enable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -All" nocase ascii wide
$string54 = /Enable\-WindowsOptionalFeature\s\-Online\:\$true\s\-FeatureName\sMicrosoft\-Hyper\-V\s\-All\:\$true/ nocase ascii wide
$string55 = "Find-LocalAdminAccess -Verbose" nocase ascii wide
$string56 = /foreach\s\(\$.{0,1000}\s\{Test\-NetConnection\s\-Port\s/ nocase ascii wide
$string57 = "gci env:USERNAME" nocase ascii wide
$string58 = /gci\s\-h\sC\:\\pagefile\.sys/ nocase ascii wide
$string59 = /Get\-ADComputer\s\-Filter\s\{TrustedForDelegation\s\-eq\s\$True\}/ nocase ascii wide
$string60 = /Get\-ADGroup\s\-Filter\s.{0,1000}Name\s\-like\s.{0,1000}admin/ nocase ascii wide
$string61 = "Get-ADGroupMember Administrators -Recursive" nocase ascii wide
$string62 = "Get-ADGroupMember -Identity \"Domain Admins\"" nocase ascii wide
$string63 = /Get\-ADObject\s\-Filter\s\{msDS\-AllowedToDelegateTo\s.{0,1000}\s\-Properties\smsDS\-AllowedToDelegateTo/ nocase ascii wide
$string64 = /Get\-ADObject\s\-SearchBase\s.{0,1000}CN\=Shadow\sPrincipal\sConfiguration.{0,1000}CN\=Services.{0,1000}\s\(Get\-ADRootDSE\)\.configurationNamingContext\)\s\|\sselect\s.{0,1000}msDS\-ShadowPrincipalSid/ nocase ascii wide
$string65 = /Get\-ADUser\s\-Filter\s\{DoesNotRequirePreAuth\s\-eq\s\$True\}\s\-Properties\sDoesNotRequirePreAuth/ nocase ascii wide
$string66 = /Get\-ADUser\s\-Filter\s\{TrustedForDelegation\s\-eq\s\$True\}/ nocase ascii wide
$string67 = "Get-AppLockerPolicy -Effective " nocase ascii wide
$string68 = /Get\-ChildItem\s\-Hidden\sC\:\\Users\\.{0,1000}\\AppData\\Local\\Microsoft\\Credentials\\/ nocase ascii wide
$string69 = /Get\-ChildItem\s\-Hidden\sC\:\\Users\\.{0,1000}\\AppData\\Roaming\\Microsoft\\Credentials\\/ nocase ascii wide
$string70 = /Get\-DhcpServerv4Scope\s\|\sSet\-DhcpServerv4OptionValue\s\-DnsServer\s/ nocase ascii wide
$string71 = "Get-DomainComputer -TrustedToAuth" nocase ascii wide
$string72 = "Get-DomainUser -KerberosPreuthNotRequired -Verbose" nocase ascii wide
$string73 = "Get-GPO -All" nocase ascii wide
$string74 = "Get-LoggedonLocal -ComputerName " nocase ascii wide
$string75 = "Get-MpComputerStatus" nocase ascii wide
$string76 = /Get\-MpPreference\s\|\sSelect\-Object\s\-ExpandProperty\sExclusionPath/ nocase ascii wide
$string77 = "Get-NetGroup -FullData" nocase ascii wide
$string78 = /Get\-NetGroupMember\s\-GroupName\s.{0,1000}DNSAdmins/ nocase ascii wide
$string79 = "Get-NetUser -SPN" nocase ascii wide
$string80 = /Get\-WmiObject\sWin32_ShadowCopy\s\|\sRemove\-WmiObject/ nocase ascii wide
$string81 = /HostVersion\=2\.0.{0,1000}EngineVersion\=2\.0/ nocase ascii wide
$string82 = /IEX\s\(\[System\.Text\.Encoding\]\:\:UTF8\.GetString\(\[System\.Convert\]\:\:FromBase64String\(/ nocase ascii wide
$string83 = /IEX\(New\-Object\sSystem\.Net\.WebClient\)\.DownloadString\(\\"https\:\/\/raw\.githubusercontent\.com\// nocase ascii wide
$string84 = "Install-PswaWebApplication -UseTestCertificate" nocase ascii wide
$string85 = "Install-PswaWebApplication" nocase ascii wide
$string86 = "Install-WindowsFeature -Name Web-Server -IncludeManagementTools" nocase ascii wide
$string87 = "Install-WindowsFeature WindowsPowerShellWebAccess" nocase ascii wide
$string88 = "Invoke-EnumerateLocalAdmin -Verbose" nocase ascii wide
$string89 = /invoke\-expression\(\[System\.Text\.Encoding\]\:\:UTF8\.GetString\(\[System\.Convert\]\:\:FromBase64String\(/ nocase ascii wide
$string90 = "Invoke-UserHunter -CheckAccess" nocase ascii wide
$string91 = /Invoke\-WebRequest\sifconfig\.me\/ip.{0,1000}Content\.Trim\(\)/ nocase ascii wide
$string92 = "ls env:USERNAME" nocase ascii wide
$string93 = "New-ADGroup -Name \"ESX Admins\"" nocase ascii wide
$string94 = /New\-ItemProperty\s\-Path\s\\"HKLM\:\\Software\\Microsoft\\Windows\sNT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist\\"\s\-Name\s.{0,1000}\s\-Value\s0\s\-PropertyType\sDword/ nocase ascii wide
$string95 = /New\-ItemProperty\s\-Path\s\\"HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels\\"\s\-Name\s\\"DisableDevTunnelsInVisualStudio\\"\s\-PropertyType\sDWORD\s\-Value\s0/ nocase ascii wide
$string96 = /New\-ItemProperty\s\-Path\s\\"HKLM\:\\SOFTWARE\\Policies\\Microsoft\\Windows\sDefender\\"\s\-Name\sDisableAntiSpyware\s\-Value\s1\s\-PropertyType\sDWORD\s\-Force\s/ nocase ascii wide
$string97 = /New\-NetFirewallRule\s.{0,1000}\s\-Enabled\sTrue\s\-Direction\sInbound\s\-Protocol\sTCP\s\-Action\sAllow\s\-LocalPort\s22/ nocase ascii wide
$string98 = /New\-Object\sSystem\.Net\.Sockets\.TCPClient\(.{0,1000}\$stream\s\=\s\$client\.GetStream\(\).{0,1000}\[byte\[\]\]\$bytes\s\=\s0\.\.65535/ nocase ascii wide
$string99 = /powershell\s\?encodedcommand\s\$env\:PSExecutionPolicyPreference\=\\"bypass\\"/ nocase ascii wide
$string100 = "powershell -c \"Clear-History\"" nocase ascii wide
$string101 = /powershell\s\-c\s.{0,1000}\\windows\\system32\\inetsrv\\appcmd\.exe\slist\sapppool\s\/\@t\:/ nocase ascii wide
$string102 = "powershell -c clear" nocase ascii wide
$string103 = /powershell\sNew\-ItemProperty\s\-Path\s.{0,1000}HKLM\:\\SOFTWARE\\Policies\\Microsoft\\Windows\sDefender.{0,1000}\s\-Name\sDisableAntiSpyware\s\-Value\s1\s\-PropertyType\sDWORD\s\-Force/ nocase ascii wide
$string104 = "powershell Uninstall-WindowsFeature -Name Windows-Defender" nocase ascii wide
$string105 = "PowerShell -Version 2 -Command " nocase ascii wide
$string106 = "powershell -Version 2" nocase ascii wide
$string107 = /powershell.{0,1000}Uninstall\-WindowsFeature\s\-Name\sWindows\-Defender\-GUI/ nocase ascii wide
$string108 = /Powershell\.exe\s\s\-windowstyle\shidden\s\-nop\s\-ExecutionPolicy\sBypass\s\s\-Commmand\s.{0,1000}C\:\\Users\\.{0,1000}\\AppData\\Roaming\\/ nocase ascii wide
$string109 = /powershell\.exe\scurl\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
$string110 = /powershell\.exe\s\-exec\sbypass\s\-noni\s\-nop\s\-w\s1\s\-C/ nocase ascii wide
$string111 = /powershell\.exe\s\-exec\sbypass\s\-noni\s\-nop\s\-w\s1\s\-C.{0,1000}invoke_obfuscation/ nocase ascii wide
$string112 = /powershell\.exe\sInvoke\-WebRequest\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
$string113 = /powershell\.exe\siwr\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
$string114 = /powershell\.exe\s\-noni\s\-nop\s\-w\s1\s\-enc\s/ nocase ascii wide
$string115 = /powershell\.exe\s\-NoP\s\-NoL\s\-sta\s\-NonI\s\-W\sHidden\s\-Exec\sBypass\s\-Enc\s/ nocase ascii wide
$string116 = /powershell\.exe\s\-nop\s\-w\shidden\s\-c\s\\"IEX\s\(\(new\-object\snet\.webclient\)\.downloadstring\(\'http\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
$string117 = /PowerShell\.exe\s\-Version\s2\s\-Command\s/ nocase ascii wide
$string118 = /powershell\.exe\s\-Version\s2/ nocase ascii wide
$string119 = /powershell\.exe\swget\shttp\:\/\/\[0\-9\]\{1\,3\}/ nocase ascii wide
$string120 = /powershell\.exe\\"\s\-Version\s2/ nocase ascii wide
$string121 = /reg\sdelete\s.{0,1000}\s\/v\sMRUList\s\/f/ nocase ascii wide
$string122 = /Remove\-Item\s\-LiteralPath\s\\"C\:\\Program\sFiles\s\(x86\)\\Sophos\\"\s\-Force\s\-Recurse/ nocase ascii wide
$string123 = /Remove\-Item\s\-LiteralPath\s\\"C\:\\Program\sFiles\\Sophos\\"\s\-Force\s\-Recurse/ nocase ascii wide
$string124 = /Remove\-Item\s\-LiteralPath\s\\"C\:\\Program\sFiles\\Sophos.{0,1000}\\"\s\-Force\s\-Recurse/ nocase ascii wide
$string125 = /Remove\-Item\s\-LiteralPath\s\\"C\:\\ProgramData\\Sophos\\"\s\-Force\s\-Recurse/ nocase ascii wide
$string126 = /Remove\-ItemProperty\s\-Path\s\\"HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels\\"\s\-Name\s\\"DisableDevTunnelsInVisualStudio\\"/ nocase ascii wide
$string127 = /Remove\-ItemProperty\s\-Path.{0,1000}\s\-Name\sMRUList\s/ nocase ascii wide
$string128 = /Remove\-ItemProperty.{0,1000}HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels.{0,1000}DisableDevTunnelsInVisualStudio/ nocase ascii wide
$string129 = /root\/SecurityCenter2.{0,1000}\s\-ClassName\sAntiVirusProduct/ nocase ascii wide
$string130 = /S\`eT\-It\`em\s\(\s\'V\'\+\'aR\'\s\+\s\s\'IA\'\s\+\s\(\'blE\:1\'\+\'q2\'\)/ nocase ascii wide
$string131 = /Set\-ADObject\s\-SamAccountName\s.{0,1000}\s\-PropertyName\sscriptpath\s\-PropertyValue\s.{0,1000}\\.{0,1000}\.exe/ nocase ascii wide
$string132 = "Set-Clipboard -Value ' '" nocase ascii wide
$string133 = "Set-Clipboard -Value ''" nocase ascii wide
$string134 = /Set\-ItemProperty.{0,1000}HKLM\:\\SOFTWARE\\Policies\\Microsoft\\VisualStudio\\Devtunnels.{0,1000}DisableDevTunnelsInVisualStudio.{0,1000}0/ nocase ascii wide
$string135 = /Set\-MPPreference\s\-DisableIntrusionPreventionSystem\s\$true/ nocase ascii wide
$string136 = /Set\-MpPreference\s\-DisableIOAVProtection\s\$true/ nocase ascii wide
$string137 = /Set\-MpPreference\s\-DisableRealtimeMonitoring\s\$true/ nocase ascii wide
$string138 = "Set-MpPreference -DisableScriptScanning 1 " nocase ascii wide
$string139 = "Set-MpPreference -ExclusionExtension exe" nocase ascii wide
$string140 = "Set-Service -Name sshd -StartupType 'Automatic'" nocase ascii wide
$string141 = "Start-Service sshd" nocase ascii wide
$string142 = "Stop-Process -Name \"Sophos " nocase ascii wide
$string143 = "Stop-Process -Name \"SQL Backups\"" nocase ascii wide
$string144 = "Stop-Process -Name \"SQLsafe Backup Service\"" nocase ascii wide
$string145 = /Stop\-Process\s\-Name\s\\"storagecraft\simagemanager.{0,1000}\\"/ nocase ascii wide
$string146 = "Stop-Process -Name \"Symantec System Recovery\"" nocase ascii wide
$string147 = "Stop-Process -Name \"Veeam Backup Catalog Data Service\"" nocase ascii wide
$string148 = "Stop-Process -Name \"Zoolz 2 Service\"" nocase ascii wide
$string149 = "Stop-Process -Name acronisagent" nocase ascii wide
$string150 = "Stop-Process -Name AcronisAgent" nocase ascii wide
$string151 = "Stop-Process -Name acrsch2svc" nocase ascii wide
$string152 = "Stop-Process -Name AcrSch2Svc" nocase ascii wide
$string153 = "Stop-Process -Name agntsvc" nocase ascii wide
$string154 = "Stop-Process -Name Antivirus" nocase ascii wide
$string155 = "Stop-Process -Name ARSM /y" nocase ascii wide
$string156 = "Stop-Process -Name arsm" nocase ascii wide
$string157 = "Stop-Process -Name AVP" nocase ascii wide
$string158 = "Stop-Process -Name backp" nocase ascii wide
$string159 = "Stop-Process -Name backup" nocase ascii wide
$string160 = "Stop-Process -Name BackupExec" nocase ascii wide
$string161 = "Stop-Process -Name BackupExecAgent" nocase ascii wide
$string162 = "Stop-Process -Name bedbg /y" nocase ascii wide
$string163 = "Stop-Process -Name cbservi" nocase ascii wide
$string164 = "Stop-Process -Name cbvscserv" nocase ascii wide
$string165 = "Stop-Process -Name DCAgent" nocase ascii wide
$string166 = "Stop-Process -Name EhttpSrv" nocase ascii wide
$string167 = "Stop-Process -Name ekrn" nocase ascii wide
$string168 = "Stop-Process -Name EPSecurityService" nocase ascii wide
$string169 = "Stop-Process -Name EPUpdateService" nocase ascii wide
$string170 = "Stop-Process -Name EsgShKernel" nocase ascii wide
$string171 = "Stop-Process -Name ESHASRV" nocase ascii wide
$string172 = "Stop-Process -Name FA_Scheduler" nocase ascii wide
$string173 = "Stop-Process -Name IMAP4Svc" nocase ascii wide
$string174 = "Stop-Process -Name KAVFS" nocase ascii wide
$string175 = "Stop-Process -Name KAVFSGT" nocase ascii wide
$string176 = "Stop-Process -Name kavfsslp" nocase ascii wide
$string177 = "Stop-Process -Name klnagent" nocase ascii wide
$string178 = "Stop-Process -Name macmnsvc" nocase ascii wide
$string179 = "Stop-Process -Name masvc" nocase ascii wide
$string180 = "Stop-Process -Name MBAMService" nocase ascii wide
$string181 = "Stop-Process -Name MBEndpointAgent" nocase ascii wide
$string182 = "Stop-Process -Name McAfeeEngineService" nocase ascii wide
$string183 = "Stop-Process -Name McAfeeFramework" nocase ascii wide
$string184 = "Stop-Process -Name McAfeeFrameworkMcAfeeFramework" nocase ascii wide
$string185 = "Stop-Process -Name McShield" nocase ascii wide
$string186 = "Stop-Process -Name mfefire" nocase ascii wide
$string187 = "Stop-Process -Name mfemms" nocase ascii wide
$string188 = "Stop-Process -Name mfevtp" nocase ascii wide
$string189 = "Stop-Process -Name mozyprobackup" nocase ascii wide
$string190 = "Stop-Process -Name MsDtsServer" nocase ascii wide
$string191 = "Stop-Process -Name MsDtsServer100" nocase ascii wide
$string192 = "Stop-Process -Name MsDtsServer110" nocase ascii wide
$string193 = /Stop\-Process\s\-Name\smsftesql\$PROD/ nocase ascii wide
$string194 = /Stop\-Process\s\-Name\sMSOLAP\$SQL_2008/ nocase ascii wide
$string195 = /Stop\-Process\s\-Name\sMSOLAP\$SYSTEM_BGC/ nocase ascii wide
$string196 = /Stop\-Process\s\-Name\sMSOLAP\$TPS/ nocase ascii wide
$string197 = /Stop\-Process\s\-Name\sMSOLAP\$TPSAMA/ nocase ascii wide
$string198 = /Stop\-Process\s\-Name\sMSSQL\$BKUPEXEC/ nocase ascii wide
$string199 = /Stop\-Process\s\-Name\sMSSQL\$ECWDB2/ nocase ascii wide
$string200 = /Stop\-Process\s\-Name\sMSSQL\$PRACTICEMGT/ nocase ascii wide
$string201 = /Stop\-Process\s\-Name\sMSSQL\$PRACTTICEBGC/ nocase ascii wide
$string202 = /Stop\-Process\s\-Name\sMSSQL\$PROD/ nocase ascii wide
$string203 = /Stop\-Process\s\-Name\sMSSQL\$PROFXENGAGEMENT/ nocase ascii wide
$string204 = /Stop\-Process\s\-Name\sMSSQL\$SBSMONITORING/ nocase ascii wide
$string205 = /Stop\-Process\s\-Name\sMSSQL\$SHAREPOINT/ nocase ascii wide
$string206 = /Stop\-Process\s\-Name\sMSSQL\$SOPHOS/ nocase ascii wide
$string207 = /Stop\-Process\s\-Name\sMSSQL\$SQL_2008/ nocase ascii wide
$string208 = /Stop\-Process\s\-Name\sMSSQL\$SQLEXPRESS/ nocase ascii wide
$string209 = /Stop\-Process\s\-Name\sMSSQL\$SYSTEM_BGC/ nocase ascii wide
$string210 = /Stop\-Process\s\-Name\sMSSQL\$TPS/ nocase ascii wide
$string211 = /Stop\-Process\s\-Name\sMSSQL\$TPSAMA/ nocase ascii wide
$string212 = /Stop\-Process\s\-Name\sMSSQL\$VEEAMSQL/ nocase ascii wide
$string213 = /Stop\-Process\s\-Name\sMSSQL\$VEEAMSQL/ nocase ascii wide
$string214 = "Stop-Process -Name sacsvr" nocase ascii wide
$string215 = "Stop-Process -Name SAVAdminService" nocase ascii wide
$string216 = "Stop-Process -Name SAVService" nocase ascii wide
$string217 = "Stop-Process -Name shadowprotectsvc" nocase ascii wide
$string218 = "Stop-Process -Name ShMonitor" nocase ascii wide
$string219 = "Stop-Process -Name Smcinst" nocase ascii wide
$string220 = "Stop-Process -Name SmcService" nocase ascii wide
$string221 = "Stop-Process -Name sms_site_sql_backup" nocase ascii wide
$string222 = "Stop-Process -Name SntpService" nocase ascii wide
$string223 = "Stop-Process -Name sophossps" nocase ascii wide
$string224 = "Stop-Process -Name spxservice" nocase ascii wide
$string225 = "Stop-Process -Name sqbcoreservice" nocase ascii wide
$string226 = /Stop\-Process\s\-Name\sSQLAgent\$SOPH/ nocase ascii wide
$string227 = /Stop\-Process\s\-Name\sSQLAgent\$VEEAMSQL/ nocase ascii wide
$string228 = /Stop\-Process\s\-Name\sSQLAgent\$VEEAMSQL/ nocase ascii wide
$string229 = "Stop-Process -Name stc_endpt_svc" nocase ascii wide
$string230 = "Stop-Process -Name stop SepMasterService" nocase ascii wide
$string231 = "Stop-Process -Name svcGenericHost" nocase ascii wide
$string232 = "Stop-Process -Name swi_filter" nocase ascii wide
$string233 = "Stop-Process -Name swi_service" nocase ascii wide
$string234 = "Stop-Process -Name swi_update" nocase ascii wide
$string235 = "Stop-Process -Name swi_update_64" nocase ascii wide
$string236 = "Stop-Process -Name TmCCSF" nocase ascii wide
$string237 = "Stop-Process -Name tmlisten" nocase ascii wide
$string238 = "Stop-Process -Name TrueKey" nocase ascii wide
$string239 = "Stop-Process -Name TrueKeyScheduler" nocase ascii wide
$string240 = "Stop-Process -Name TrueKeyServiceHel" nocase ascii wide
$string241 = "Stop-Process -Name vapiendpoint" nocase ascii wide
$string242 = "Stop-Process -Name VeeamBackupSvc" nocase ascii wide
$string243 = "Stop-Process -Name VeeamBrokerSvc " nocase ascii wide
$string244 = "Stop-Process -Name VeeamCatalogSvc" nocase ascii wide
$string245 = "Stop-Process -Name VeeamCloudSvc" nocase ascii wide
$string246 = "Stop-Process -Name VeeamDeploymentService" nocase ascii wide
$string247 = "Stop-Process -Name VeeamDeploySvc" nocase ascii wide
$string248 = "Stop-Process -Name VeeamDeploySvc" nocase ascii wide
$string249 = "Stop-Process -Name VeeamEnterpriseManagerSvc" nocase ascii wide
$string250 = "Stop-Process -Name VeeamHvIntegrationSvc" nocase ascii wide
$string251 = "Stop-Process -Name VeeamMountSvc" nocase ascii wide
$string252 = "Stop-Process -Name VeeamNFSSvc" nocase ascii wide
$string253 = "Stop-Process -Name VeeamRESTSvc" nocase ascii wide
$string254 = "Stop-Process -Name VeeamTransportSvc" nocase ascii wide
$string255 = "Stop-Process -Name vsnapvss" nocase ascii wide
$string256 = "Stop-Process -Name vssvc" nocase ascii wide
$string257 = "Stop-Process -Name wbengine" nocase ascii wide
$string258 = "Stop-Process -Name wbengine" nocase ascii wide
$string259 = "Stop-Process -Name WRSVC" nocase ascii wide
$string260 = /System\.IO\.MemoryStream\(\,\[System\.Convert\]\:\:FromBase64String\(/ nocase ascii wide
$string261 = "Uninstall-WindowsFeature -Name Windows-Defender" nocase ascii wide
condition:
any of them
}