SEKOIA.IO Rules medium stable sigma

Suspicious PowerShell Keywords

Detects keywords that could indicate the use of some PowerShell exploitation framework.

View Source

Detection Logic

scriptblocktext:
  action.properties.ScriptBlockText
| contains:
    - System.Reflection.Assembly.Load($
    - "[System.Reflection.Assembly]::Load($"
    - "[Reflection.Assembly]::Load($"
    - System.Reflection.AssemblyName
    - Reflection.Emit.AssemblyBuilderAccess
    - Runtime.InteropServices.DllImportAttribute
    - SuspendThread
    - DefineDynamicModule
    - GetDelegateForFunctionPointer
    - System.Reflection.CallingConventions
process:
  process.command_line
| contains:
    - System.Reflection.Assembly.Load($
    - "[System.Reflection.Assembly]::Load($"
    - "[Reflection.Assembly]::Load($"
    - System.Reflection.AssemblyName
    - Reflection.Emit.AssemblyBuilderAccess
    - Runtime.InteropServices.DllImportAttribute
    - SuspendThread
    - DefineDynamicModule
    - GetDelegateForFunctionPointer
    - System.Reflection.CallingConventions
filter:
  - action.properties.ScriptBlockText
| contains: ProgramData\N-Able Technologies\AutomationManager
condition: (scriptblocktext or process) and not filter

Field Validations

Loading…

Comments (0)

Loading comments...