PowerView PowerShell Cmdlets - ScriptBlock

SIGMA detection rule by Bhabesh Raj · GPL-2.0

Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

title: PowerView PowerShell Cmdlets - ScriptBlock
id: cc813de1-cf1f-dd91-bcfb-3821610d9dfc
related:
    - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
      type: similar
    - id: dcd74b95-3f36-4ed9-9598-0490951643aa
      type: derived
status: test
description: Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.
references:
    - https://powersploit.readthedocs.io/en/stable/Recon/README
    - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
    - https://thedfirreport.com/2020/10/08/ryuks-return
    - https://adsecurity.org/?p=2277
author: Bhabesh Raj
date: 2021-05-18
modified: 2023-11-22
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    ps_script:
        EventID: 4104
        Channel:
            - Microsoft-Windows-PowerShell/Operational
            - PowerShellCore/Operational
    selection:
        ScriptBlockText|contains:
            - Export-PowerViewCSV
            - Find-DomainLocalGroupMember
            - Find-DomainObjectPropertyOutlier
            - Find-DomainProcess
            - Find-DomainShare
            - Find-DomainUserEvent
            - Find-DomainUserLocation
            - Find-ForeignGroup
            - Find-ForeignUser
            - Find-GPOComputerAdmin
            - Find-GPOLocation
            - Find-InterestingDomain   # Covers: Find-InterestingDomainAcl, Find-InterestingDomainShareFile
            - Find-InterestingFile
            - Find-LocalAdminAccess
            - Find-ManagedSecurityGroups
            - Get-CachedRDPConnection
            - Get-DFSshare
            - Get-DomainDFSShare
            - Get-DomainDNSRecord
            - Get-DomainDNSZone
            - Get-DomainFileServer
            - Get-DomainGPOComputerLocalGroupMapping
            - Get-DomainGPOLocalGroup
            - Get-DomainGPOUserLocalGroupMapping
            - Get-LastLoggedOn
            - Get-LoggedOnLocal
            - Get-NetFileServer
            - Get-NetForest   # Covers: Get-NetForestCatalog, Get-NetForestDomain, Get-NetForestTrust
            - Get-NetGPOGroup
            - Get-NetProcess
            - Get-NetRDPSession
            - Get-RegistryMountedDrive
            - Get-RegLoggedOn
            - Get-WMIRegCachedRDPConnection
            - Get-WMIRegLastLoggedOn
            - Get-WMIRegMountedDrive
            - Get-WMIRegProxy
            - Invoke-ACLScanner
            - Invoke-CheckLocalAdminAccess
            - Invoke-EnumerateLocalAdmin
            - Invoke-EventHunter
            - Invoke-FileFinder
            - Invoke-Kerberoast
            - Invoke-MapDomainTrust
            - Invoke-ProcessHunter
            - Invoke-RevertToSelf
            - Invoke-ShareFinder
            - Invoke-UserHunter
            - Invoke-UserImpersonation
            - Remove-RemoteConnection
            - Request-SPNTicket
            - Resolve-IPAddress
            # - 'Get-ADObject'  # prone to FPs
            # - 'Get-Domain'  # too many FPs  # Covers Cmdlets like: DomainComputer, DomainController, DomainDFSShare, DomainDNSRecord, DomainGPO, etc.
            # - 'Add-DomainGroupMember'
            # - 'Add-DomainObjectAcl'
            # - 'Add-ObjectAcl'
            # - 'Add-RemoteConnection'
            # - 'Convert-ADName'
            # - 'Convert-NameToSid'
            # - 'ConvertFrom-UACValue'
            # - 'ConvertTo-SID'
            # - 'Get-DNSRecord'
            # - 'Get-DNSZone'
            # - 'Get-DomainComputer'
            # - 'Get-DomainController'
            # - 'Get-DomainGroup'
            # - 'Get-DomainGroupMember'
            # - 'Get-DomainManagedSecurityGroup'
            # - 'Get-DomainObject'
            # - 'Get-DomainObjectAcl'
            # - 'Get-DomainOU'
            # - 'Get-DomainPolicy'
            # - 'Get-DomainSID'
            # - 'Get-DomainSite'
            # - 'Get-DomainSPNTicket'
            # - 'Get-DomainSubnet'
            # - 'Get-DomainUser'
            # - 'Get-DomainUserEvent'
            # - 'Get-Forest' # Covers: Get-ForestDomain, Get-ForestGlobalCatalog, Get-ForestTrust
            # - 'Get-IPAddress'
            # - 'Get-NetComputer' # Covers: Get-NetComputerSiteName
            # - 'Get-NetDomain' # Covers: Get-NetDomainController, Get-NetDomainTrust
            # - 'Get-NetGroup' # Covers: Get-NetGroupMember
            # - 'Get-NetLocalGroup' # Covers: NetLocalGroupMember
            # - 'Get-NetLoggedon'
            # - 'Get-NetOU'
            # - 'Get-NetSession'
            # - 'Get-NetShare'
            # - 'Get-NetSite'
            # - 'Get-NetSubnet'
            # - 'Get-NetUser'
            # - 'Get-ObjectAcl'
            # - 'Get-PathAcl'
            # - 'Get-Proxy'
            # - 'Get-SiteName'
            # - 'Get-UserEvent'
            # - 'Get-WMIProcess'
            # - 'New-DomainGroup'
            # - 'New-DomainUser'
            # - 'Set-ADObject'
            # - 'Set-DomainObject'
            # - 'Set-DomainUserPassword'
            # - 'Test-AdminAccess'
    condition: ps_script and selection
falsepositives:
    - Unknown
level: high
ruletype: Sigma

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

9269333c-76aa-4618-a8e6-e49f8119dc2d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion