UtilityFunctions.ps1 Proxy Dll

Title: UtilityFunctions.ps1 Proxy Dll
Status: test
Description:Detects the use of a Microsoft signed script executing a managed DLL with PowerShell.
References:
  -https://lolbas-project.github.io/lolbas/Scripts/UtilityFunctions/
Author: frack113
Date: 2022-05-28
modified:None
Tags:

• -'attack.stealth'
• -'attack.t1216'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    CommandLine|contains:
      -'UtilityFunctions.ps1'
      -'RegSnapin '

  condition:selection
Falsepositives:
  -Unknown
Level: medium