Sigma rule: PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script

Rule

Title

PowerShell Dynamic Module Invocation Via ExportedCommands Array Index - PS Script

Status

experimental

Level

medium

Author

Norbert Jaśniewicz (AlphaSOC)

Date

2026-10-06

File

rules/windows/powershell/powershell_script/posh_ps_cmdlet_invocation_via_exported_commands_array_index.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects obfuscated PowerShell scripts that enumerate Microsoft.PowerShell.Utility exported commands
and invoke cmdlets indirectly by array index. This can be used to evade detections
that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection_module_export_enum:
    ScriptBlockText|contains:
        - 'Get-Module '
        - 'gmo '
    ScriptBlockText|contains|all:
        - 'ListAvailable'
        - 'Microsoft.PowerShell.Utility'
        - 'ExportedCommands'
        - 'Values'
selection_index_used:
    ScriptBlockText|contains: '[*]'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate use of exported commands array indexing in PowerShell scripts (should be rare)

Tags

• attack.execution
• attack.stealth
• attack.t1027
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1027
• T1059.001

Related rules

• 0c3ebe9f-df09-4e00-be0f-73d4ca8d62f6 (similar)

References

• https://www.linkedin.com/posts/mark-o-halloran1_clickfix-defense-evasion-tactic-today-i-ugcPost-7453463467736408064-snrp/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_cmdlet_invocation_via_exported_commands_array_index.yml