PowerShell PSAttack

Title: PowerShell PSAttack
Status: test
Description:Detects the use of PSAttack PowerShell hack tool
References:
  -https://adsecurity.org/?p=2921
Author: Sean Metcalf (source), Florian Roth (Nextron Systems)
Date: 2017-03-05
modified:2022-12-25
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains: 'PS ATTACK!!!'
  condition:selection
Falsepositives:
  -Unknown
Level: high