Suspicious PowerShell Invocations - Specific

Title: Suspicious PowerShell Invocations - Specific
Status: test
Description:Detects suspicious PowerShell invocation command parameters
References:
  -Internal Research
  -https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro
Date: 2017-03-05
modified:2025-02-17
Tags:

• -'attack.execution'
• -'attack.t1059.001'

Logsource:

• product: windows
• category: ps_script
• definition: Requirements: Script Block Logging must be enabled

Detection:
  selection_convert_b64:
    ScriptBlockText|contains|all:
      -'-nop'
      -' -w '
      -'hidden'
      -' -c '
      -'[Convert]::FromBase64String'

  selection_iex_selection:
    ScriptBlockText|contains|all:
      -' -w '
      -'hidden'
      -'-noni'
      -'-nop'
      -' -c '
      -'iex'
      -'New-Object'

  selection_enc_selection:
    ScriptBlockText|contains|all:
      -' -w '
      -'hidden'
      -'-ep'
      -'bypass'
      -'-Enc'

  selection_reg_selection:
    ScriptBlockText|contains|all:
      -'powershell'
      -'reg'
      -'add'

    ScriptBlockText|contains:
      -'\software\microsoft\windows\currentversion\run'
      -'\software\wow6432node\microsoft\windows\currentversion\run'
      -'\software\microsoft\windows\currentversion\policies\explorer\run'

  selection_webclient_selection:
    ScriptBlockText|contains|all:
      -'bypass'
      -'-noprofile'
      -'-windowstyle'
      -'hidden'
      -'new-object'
      -'system.net.webclient'
      -'.download'

  selection_iex_webclient:
    ScriptBlockText|contains|all:
      -'iex'
      -'New-Object'
      -'Net.WebClient'
      -'.Download'

  filter_chocolatey:
    ScriptBlockText|contains:
      -'(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1'
      -'(New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1')'
      -'Write-ChocolateyWarning'

  condition:1 of selection_* and not 1 of filter_*
Falsepositives:
  -Unknown
Level: high