Suspicious PowerShell Invocations - Specific - PowerShell Module

Title: Suspicious PowerShell Invocations - Specific - PowerShell Module
Status: test
Description:Detects suspicious PowerShell invocation command parameters
References:
  -Internal Research
  -https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Date: 2017-03-05
modified:2025-02-17
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_module
• definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b

Detection:
  selection_convert_b64:
    ContextInfo|contains|all:
      -'-nop'
      -' -w '
      -'hidden'
      -' -c '
      -'[Convert]::FromBase64String'

  selection_iex:
    ContextInfo|contains|all:
      -' -w '
      -'hidden'
      -'-noni'
      -'-nop'
      -' -c '
      -'iex'
      -'New-Object'

  selection_enc:
    ContextInfo|contains|all:
      -' -w '
      -'hidden'
      -'-ep'
      -'bypass'
      -'-Enc'

  selection_reg:
    ContextInfo|contains|all:
      -'powershell'
      -'reg'
      -'add'

    ContextInfo|contains:
      -'\software\microsoft\windows\currentversion\run'
      -'\software\wow6432node\microsoft\windows\currentversion\run'
      -'\software\microsoft\windows\currentversion\policies\explorer\run'

  selection_webclient:
    ContextInfo|contains|all:
      -'bypass'
      -'-noprofile'
      -'-windowstyle'
      -'hidden'
      -'new-object'
      -'system.net.webclient'
      -'.download'

  selection_iex_webclient:
    ContextInfo|contains|all:
      -'iex'
      -'New-Object'
      -'Net.WebClient'
      -'.Download'

  filter_chocolatey:
    ContextInfo|contains:
      -'(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'
      -'Write-ChocolateyWarning'

  condition:1 of selection_* and not 1 of filter_*
Falsepositives:
  -Unknown
Level: high