PowerShell Script With File Hostname Resolving Capabilities

Title: PowerShell Script With File Hostname Resolving Capabilities
Status: test
Description:Detects PowerShell scripts that have capabilities to read files, loop through them and resolve DNS host entries.
References:
  -https://www.fortypoundhead.com/showcontent.asp?artid=24022
  -https://labs.withsecure.com/publications/fin7-target-veeam-servers
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-05-05
modified:None
Tags:

• -'attack.exfiltration'
• -'attack.t1020'

Logsource:

• product: windows
• category: ps_script
• definition: bade5735-5ab0-4aa7-a642-a11be0e40872

Detection:
  selection:
    ScriptBlockText|contains|all:
      -'Get-content '
      -'foreach'
      -'[System.Net.Dns]::GetHostEntry'
      -'Out-File'

  condition:selection
Falsepositives:
  -The same functionality can be implemented by admin scripts, correlate with name and creator
Level: medium