Sigma rule: HackTool - Evil-WinRm Execution - PowerShell Module

Rule

Title

HackTool - Evil-WinRm Execution - PowerShell Module

Status

test

Level

high

Author

Nasreddine Bencherchali (Nextron Systems)

Date

2024-02-25

File

rules/windows/powershell/powershell_module/posh_pm_hktl_evil_winrm_execution.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.

Log source

product

windows

category

ps_module

Detection

selection_wsm:
    ContextInfo|contains:
        - ':\Windows\System32\wsmprovhost.exe'
        - ':\Windows\SysWOW64\wsmprovhost.exe'
selection_payload_1:
    Payload|contains:
        - value="(get-location).path # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L592
        - value="(get-item*).length # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L490
        - 'Invoke-Binary ' # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L740
        - Donut-Loader -process_id*-donutfile # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L761
        - Bypass-4MSI
        - IEX ([System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String($a))).replace('???','')
selection_payload_2:
    Payload|contains|all:
        - $servicios = Get-ItemProperty "registry::HKLM\System\CurrentControlSet\Services\"
        - Where-Object {$_.imagepath -notmatch "system" -and $_.imagepath -ne $null } | Select-Object pschildname,imagepath
selection_payload_3:
    Payload|contains|all:
        - $a +=  \"$($_.FullName.Replace('\\','/'))/\"}else{  $a += \"$($_.FullName.Replace('\\', '/'))\" } # https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb#L1001
        - $a=@();$
condition: selection_wsm and 1 of selection_payload_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.lateral-movement

References

• https://github.com/Hackplayers/evil-winrm/blob/7514b055d67ec19836e95c05bd63e7cc47c4c2aa/evil-winrm.rb
• https://github.com/search?q=repo%3AHackplayers%2Fevil-winrm++shell.run%28&type=code

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_module/posh_pm_hktl_evil_winrm_execution.yml