Malicious Nishang PowerShell Commandlets

SIGMA detection rule by Alec Costello · NOASSERTION

Detects Commandlet names and arguments from the Nishang exploitation framework

title: Malicious Nishang PowerShell Commandlets
id: f772cee9-b7c2-4cb2-8f07-49870adc02e0
status: test
description: Detects Commandlet names and arguments from the Nishang exploitation framework
references:
    - https://github.com/samratashok/nishang
author: Alec Costello
date: 2019-05-16
modified: 2023-01-16
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'Add-ConstrainedDelegationBackdoor'
            # - 'Add-Persistence' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            # - 'Add-RegBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            # - 'Add-ScrnSaveBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            - 'Copy-VSS'
            - 'Create-MultipleSessions'
            - 'DataToEncode'
            - 'DNS_TXT_Pwnage'
            - 'Do-Exfiltration-Dns'
            - 'Download_Execute'
            - 'Download-Execute-PS'
            - 'DownloadAndExtractFromRemoteRegistry'
            - 'DumpCerts'
            - 'DumpCreds'
            - 'DumpHashes'
            - 'Enable-DuplicateToken'
            - 'Enable-Duplication'
            - 'Execute-Command-MSSQL'
            - 'Execute-DNSTXT-Code'
            - 'Execute-OnTime'
            - 'ExetoText'
            - 'exfill'
            - 'ExfilOption'
            - 'FakeDC'
            - 'FireBuster'
            - 'FireListener'
            - 'Get-Information ' # Space at the end is required. Otherwise, we get FP with Get-InformationBarrierReportDetails or Get-InformationBarrierReportSummary
            # - 'Get-PassHashes' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            - 'Get-PassHints'
            - 'Get-Web-Credentials'
            - 'Get-WebCredentials'
            - 'Get-WLAN-Keys'
            # - 'Gupt-Backdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            - 'HTTP-Backdoor'
            # - 'Invoke-ADSBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            - 'Invoke-AmsiBypass'
            - 'Invoke-BruteForce'
            - 'Invoke-CredentialsPhish'
            - 'Invoke-Decode'
            - 'Invoke-Encode'
            - 'Invoke-Interceptor'
            - 'Invoke-JSRatRegsvr'
            - 'Invoke-JSRatRundll'
            - 'Invoke-MimikatzWDigestDowngrade'
            - 'Invoke-NetworkRelay'
            # - 'Invoke-PortScan' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            # - 'Invoke-PoshRatHttp' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            - 'Invoke-PowerShellIcmp'
            - 'Invoke-PowerShellUdp'
            - 'Invoke-Prasadhak'
            - 'Invoke-PSGcat'
            - 'Invoke-PsGcatAgent'
            # - 'Invoke-PsUACme' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
            - 'Invoke-SessionGopher'
            - 'Invoke-SSIDExfil'
            # - Jitter  # Prone to FPs
            # - 'Keylogger' # Too generic to be linked to Nishang
            - 'LoggedKeys'
            - 'Nishang'
            - 'NotAllNameSpaces' # This is param to "Set-RemoteWMI"
            - 'Out-CHM'
            - 'OUT-DNSTXT'
            - 'Out-HTA'
            - 'Out-RundllCommand'
            - 'Out-SCF'
            - 'Out-SCT'
            - 'Out-Shortcut'
            - 'Out-WebQuery'
            - 'Out-Word'
            - 'Parse_Keys'
            - 'Password-List'
            - 'Powerpreter'
            - 'Remove-Persistence'
            - 'Remove-PoshRat'
            - 'Remove-Update'
            - 'Run-EXEonRemote'
            - 'Set-DCShadowPermissions'
            - 'Set-RemotePSRemoting'
            - 'Set-RemoteWMI'
            - 'Shellcode32'
            - 'Shellcode64'
            - 'StringtoBase64'
            - 'TexttoExe'
    condition: selection
falsepositives:
    - Unknown
level: high
regression_tests_path: regression_data/rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets/info.yml

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

96a61b53-e6f8-4a1f-84bf-35ddc4a6d74b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion