Sigma rule: Malicious PowerShell Keywords

Rule

Title

Malicious PowerShell Keywords

Status

test

Level

medium

Author

Sean Metcalf (source), Florian Roth (Nextron Systems)

Date

2017-03-05

Modified

2023-06-20

File

rules/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects keywords from well-known PowerShell exploitation frameworks

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection:
    ScriptBlockText|contains:
        - 'AdjustTokenPrivileges'
        - 'IMAGE_NT_OPTIONAL_HDR64_MAGIC'
        # - 'LSA_UNICODE_STRING'
        - 'Metasploit'
        - 'Microsoft.Win32.UnsafeNativeMethods'
        - 'Mimikatz'
        - 'MiniDumpWriteDump'
        - 'PAGE_EXECUTE_READ'
        - 'ReadProcessMemory.Invoke'
        - 'SE_PRIVILEGE_ENABLED'
        - 'SECURITY_DELEGATION'
        - 'TOKEN_ADJUST_PRIVILEGES'
        - 'TOKEN_ALL_ACCESS'
        - 'TOKEN_ASSIGN_PRIMARY'
        - 'TOKEN_DUPLICATE'
        - 'TOKEN_ELEVATION'
        - 'TOKEN_IMPERSONATE'
        - 'TOKEN_INFORMATION_CLASS'
        - 'TOKEN_PRIVILEGES'
        - 'TOKEN_QUERY'
condition: selection

False positives (as the rule lists them)

• Depending on the scripts, this rule might require some initial tuning to fit the environment

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• https://adsecurity.org/?p=2921

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml