Sigma rule: Suspicious PowerShell Invocations - Specific

Rule

Title

Suspicious PowerShell Invocations - Specific

Status

deprecated

Level

high

Author

Florian Roth (Nextron Systems), Jonhnathan Ribeiro

Date

2017/03/05

Modified

2023/05/04

File

deprecated/windows/powershell_suspicious_invocation_specific.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects suspicious PowerShell invocation command parameters

Log source

product

windows

service

powershell

definition

Script block logging must be enabled for 4104, Module Logging must be enabled for 4103

Detection

selection_convert_b64:
    '|all':
        - '-nop'
        - ' -w '
        - 'hidden'
        - ' -c '
        - '[Convert]::FromBase64String'
selection_iex:
    '|all':
        - ' -w '
        - 'hidden'
        - '-noni'
        - '-nop'
        - ' -c '
        - 'iex'
        - 'New-Object'
selection_enc:
    '|all':
        - ' -w '
        - 'hidden'
        - '-ep'
        - 'bypass'
        - '-Enc'
selection_reg:
    '|all':
        - 'powershell'
        - 'reg'
        - 'add'
        - 'HKCU\software\microsoft\windows\currentversion\run'
selection_webclient:
     '|all':
        - 'bypass'
        - '-noprofile'
        - '-windowstyle'
        - 'hidden'
        - 'new-object'
        - 'system.net.webclient'
        - '.download'
selection_iex_webclient:
    '|all':
        - 'iex'
        - 'New-Object'
        - 'Net.WebClient'
        - '.Download'
filter_chocolatey:
    - "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
    - "(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')"
    - 'Write-ChocolateyWarning'
condition: 1 of selection_* and not 1 of filter_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.001

MITRE ATT&CK ids this rule names

• T1059.001

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/deprecated/windows/powershell_suspicious_invocation_specific.yml