Sigma rule: PowerView PowerShell Cmdlets - ScriptBlock

Rule

Title

PowerView PowerShell Cmdlets - ScriptBlock

Status

test

Level

high

Author

Bhabesh Raj

Date

2021-05-18

Modified

2023-11-22

File

rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Cmdlet names from PowerView of the PowerSploit exploitation framework.

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection:
    ScriptBlockText|contains:
        - 'Export-PowerViewCSV'
        - 'Find-DomainLocalGroupMember'
        - 'Find-DomainObjectPropertyOutlier'
        - 'Find-DomainProcess'
        - 'Find-DomainShare'
        - 'Find-DomainUserEvent'
        - 'Find-DomainUserLocation'
        - 'Find-ForeignGroup'
        - 'Find-ForeignUser'
        - 'Find-GPOComputerAdmin'
        - 'Find-GPOLocation'
        - 'Find-InterestingDomain' # Covers: Find-InterestingDomainAcl, Find-InterestingDomainShareFile
        - 'Find-InterestingFile'
        - 'Find-LocalAdminAccess'
        - 'Find-ManagedSecurityGroups'
        - 'Get-CachedRDPConnection'
        - 'Get-DFSshare'
        - 'Get-DomainDFSShare'
        - 'Get-DomainDNSRecord'
        - 'Get-DomainDNSZone'
        - 'Get-DomainFileServer'
        - 'Get-DomainGPOComputerLocalGroupMapping'
        - 'Get-DomainGPOLocalGroup'
        - 'Get-DomainGPOUserLocalGroupMapping'
        - 'Get-LastLoggedOn'
        - 'Get-LoggedOnLocal'
        - 'Get-NetFileServer'
        - 'Get-NetForest' # Covers: Get-NetForestCatalog, Get-NetForestDomain, Get-NetForestTrust
        - 'Get-NetGPOGroup'
        - 'Get-NetProcess'
        - 'Get-NetRDPSession'
        - 'Get-RegistryMountedDrive'
        - 'Get-RegLoggedOn'
        - 'Get-WMIRegCachedRDPConnection'
        - 'Get-WMIRegLastLoggedOn'
        - 'Get-WMIRegMountedDrive'
        - 'Get-WMIRegProxy'
        - 'Invoke-ACLScanner'
        - 'Invoke-CheckLocalAdminAccess'
        - 'Invoke-EnumerateLocalAdmin'
        - 'Invoke-EventHunter'
        - 'Invoke-FileFinder'
        - 'Invoke-Kerberoast'
        - 'Invoke-MapDomainTrust'
        - 'Invoke-ProcessHunter'
        - 'Invoke-RevertToSelf'
        - 'Invoke-ShareFinder'
        - 'Invoke-UserHunter'
        - 'Invoke-UserImpersonation'
        - 'Remove-RemoteConnection'
        - 'Request-SPNTicket'
        - 'Resolve-IPAddress'
        # - 'Get-ADObject'  # prone to FPs
        # - 'Get-Domain'  # too many FPs  # Covers Cmdlets like: DomainComputer, DomainController, DomainDFSShare, DomainDNSRecord, DomainGPO, etc.
        # - 'Add-DomainGroupMember'
        # - 'Add-DomainObjectAcl'
        # - 'Add-ObjectAcl'
        # - 'Add-RemoteConnection'
        # - 'Convert-ADName'
        # - 'Convert-NameToSid'
        # - 'ConvertFrom-UACValue'
        # - 'ConvertTo-SID'
        # - 'Get-DNSRecord'
        # - 'Get-DNSZone'
        # - 'Get-DomainComputer'
        # - 'Get-DomainController'
        # - 'Get-DomainGroup'
        # - 'Get-DomainGroupMember'
        # - 'Get-DomainManagedSecurityGroup'
        # - 'Get-DomainObject'
        # - 'Get-DomainObjectAcl'
        # - 'Get-DomainOU'
        # - 'Get-DomainPolicy'
        # - 'Get-DomainSID'
        # - 'Get-DomainSite'
        # - 'Get-DomainSPNTicket'
        # - 'Get-DomainSubnet'
        # - 'Get-DomainUser'
        # - 'Get-DomainUserEvent'
        # - 'Get-Forest' # Covers: Get-ForestDomain, Get-ForestGlobalCatalog, Get-ForestTrust
        # - 'Get-IPAddress'
        # - 'Get-NetComputer' # Covers: Get-NetComputerSiteName
        # - 'Get-NetDomain' # Covers: Get-NetDomainController, Get-NetDomainTrust
        # - 'Get-NetGroup' # Covers: Get-NetGroupMember
        # - 'Get-NetLocalGroup' # Covers: NetLocalGroupMember
        # - 'Get-NetLoggedon'
        # - 'Get-NetOU'
        # - 'Get-NetSession'
        # - 'Get-NetShare'
        # - 'Get-NetSite'
        # - 'Get-NetSubnet'
        # - 'Get-NetUser'
        # - 'Get-ObjectAcl'
        # - 'Get-PathAcl'
        # - 'Get-Proxy'
        # - 'Get-SiteName'
        # - 'Get-UserEvent'
        # - 'Get-WMIProcess'
        # - 'New-DomainGroup'
        # - 'New-DomainUser'
        # - 'Set-ADObject'
        # - 'Set-DomainObject'
        # - 'Set-DomainUserPassword'
        # - 'Test-AdminAccess'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

Related rules

• b2317cfa-4a47-4ead-b3ff-297438c0bc2d (similar)

References

• https://powersploit.readthedocs.io/en/stable/Recon/README
• https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
• https://thedfirreport.com/2020/10/08/ryuks-return
• https://adsecurity.org/?p=2277

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml