PSAsyncShell - Asynchronous TCP Reverse Shell

Title: PSAsyncShell - Asynchronous TCP Reverse Shell
Status: test
Description:Detects the use of PSAsyncShell an Asynchronous TCP Reverse Shell written in powershell
References:
  -https://github.com/JoelGMSec/PSAsyncShell
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-04
modified:None
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection:
    ScriptBlockText|contains: 'PSAsyncShell'
  condition:selection
Falsepositives:
  -Unlikely
Level: high