Sigma rule: Malicious Nishang PowerShell Commandlets

Rule

Title

Malicious Nishang PowerShell Commandlets

Status

test

Level

high

Author

Alec Costello

Date

2019-05-16

Modified

2023-01-16

File

rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects Commandlet names and arguments from the Nishang exploitation framework

Log source

product

windows

category

ps_script

definition

Requirements: Script Block Logging must be enabled

Detection

selection:
    ScriptBlockText|contains:
        - 'Add-ConstrainedDelegationBackdoor'
        # - 'Add-Persistence' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        # - 'Add-RegBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        # - 'Add-ScrnSaveBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        - 'Copy-VSS'
        - 'Create-MultipleSessions'
        - 'DataToEncode'
        - 'DNS_TXT_Pwnage'
        - 'Do-Exfiltration-Dns'
        - 'Download_Execute'
        - 'Download-Execute-PS'
        - 'DownloadAndExtractFromRemoteRegistry'
        - 'DumpCerts'
        - 'DumpCreds'
        - 'DumpHashes'
        - 'Enable-DuplicateToken'
        - 'Enable-Duplication'
        - 'Execute-Command-MSSQL'
        - 'Execute-DNSTXT-Code'
        - 'Execute-OnTime'
        - 'ExetoText'
        - 'exfill'
        - 'ExfilOption'
        - 'FakeDC'
        - 'FireBuster'
        - 'FireListener'
        - 'Get-Information ' # Space at the end is required. Otherwise, we get FP with Get-InformationBarrierReportDetails or Get-InformationBarrierReportSummary
        # - 'Get-PassHashes' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        - 'Get-PassHints'
        - 'Get-Web-Credentials'
        - 'Get-WebCredentials'
        - 'Get-WLAN-Keys'
        # - 'Gupt-Backdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        - 'HTTP-Backdoor'
        # - 'Invoke-ADSBackdoor' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        - 'Invoke-AmsiBypass'
        - 'Invoke-BruteForce'
        - 'Invoke-CredentialsPhish'
        - 'Invoke-Decode'
        - 'Invoke-Encode'
        - 'Invoke-Interceptor'
        - 'Invoke-JSRatRegsvr'
        - 'Invoke-JSRatRundll'
        - 'Invoke-MimikatzWDigestDowngrade'
        - 'Invoke-NetworkRelay'
        # - 'Invoke-PortScan' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        # - 'Invoke-PoshRatHttp' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        - 'Invoke-PowerShellIcmp'
        - 'Invoke-PowerShellUdp'
        - 'Invoke-Prasadhak'
        - 'Invoke-PSGcat'
        - 'Invoke-PsGcatAgent'
        # - 'Invoke-PsUACme' # Covered in 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
        - 'Invoke-SessionGopher'
        - 'Invoke-SSIDExfil'
        # - Jitter  # Prone to FPs
        # - 'Keylogger' # Too generic to be linked to Nishang
        - 'LoggedKeys'
        - 'Nishang'
        - 'NotAllNameSpaces' # This is param to "Set-RemoteWMI"
        - 'Out-CHM'
        - 'OUT-DNSTXT'
        - 'Out-HTA'
        - 'Out-RundllCommand'
        - 'Out-SCF'
        - 'Out-SCT'
        - 'Out-Shortcut'
        - 'Out-WebQuery'
        - 'Out-Word'
        - 'Parse_Keys'
        - 'Password-List'
        - 'Powerpreter'
        - 'Remove-Persistence'
        - 'Remove-PoshRat'
        - 'Remove-Update'
        - 'Run-EXEonRemote'
        - 'Set-DCShadowPermissions'
        - 'Set-RemotePSRemoting'
        - 'Set-RemoteWMI'
        - 'Shellcode32'
        - 'Shellcode64'
        - 'StringtoBase64'
        - 'TexttoExe'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

References

• https://github.com/samratashok/nishang

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml