PowerShell Credential Prompt

Title: PowerShell Credential Prompt
Status: test
Description:Detects PowerShell calling a credential prompt
References:
  -https://twitter.com/JohnLaTwC/status/850381440629981184
  -https://t.co/ezOTGy1a1G
Author: John Lambert (idea), Florian Roth (Nextron Systems)
Date: 2017-04-09
modified:2022-12-25
Tags:

• -'attack.credential-access'
• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains: 'PromptForCredential'
  condition:selection
Falsepositives:
  -Unknown
Level: high