Sigma rule: Potential Suspicious PowerShell Keywords

Rule

Title

Potential Suspicious PowerShell Keywords

Status

test

Level

medium

Author

Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup)

Date

2019-02-11

Modified

2023-04-21

File

rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects potentially suspicious keywords that could indicate the use of a PowerShell exploitation framework

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection:
    ScriptBlockText|contains:
        - 'System.Reflection.Assembly.Load($'
        - '[System.Reflection.Assembly]::Load($'
        - '[Reflection.Assembly]::Load($'
        - 'System.Reflection.AssemblyName'
        - 'Reflection.Emit.AssemblyBuilderAccess'
        - 'Reflection.Emit.CustomAttributeBuilder'
        - 'Runtime.InteropServices.UnmanagedType'
        - 'Runtime.InteropServices.DllImportAttribute'
        - 'SuspendThread'
        - 'rundll32'
        # - 'FromBase64'
        # - 'Invoke-WMIMethod' # Prone to FP
        # - 'http://127.0.0.1' # Prone to FP
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462
• https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1
• https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1
• https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml