Log source category
ps_classic_start log source Sigma rules
11 Sigma detection rules in the library use the ps_classic_start log source, mostly on windows. The ps_classic_start category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.
Delete Volume Shadow Copies Via WMI With PowerShell
highShadow Copies deletion using operating systems utilities via PowerShell
windows
PowerShell Called from an Executable Version Mismatch
highDetects PowerShell called from an executable by the version mismatch method
windows
Netcat The Powershell Version
mediumAdversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
windows
Nslookup PowerShell Download Cradle
mediumDetects a powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records.
windows
PowerShell Downgrade Attack - PowerShell
mediumDetects PowerShell downgrade attack by comparing the host versions with the actually used engine version 2.0
windows
Uncommon PowerShell Hosts
mediumDetects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
windows
bXOR Operator Usage In PowerShell Command Line - PowerShell Classic
lowDetects powershell execution with that make use of to the bxor (Bitwise XOR). Attackers might use as an alternative obfuscation method to Base64 encoded commands. Investigate the CommandLine and process tree to determine if the activity is malicious.
windows
PowerShell Download Via Net.WebClient - PowerShell Classic
lowDetects PowerShell download activity, via the .DownloadFile() or .DownloadString() methods of the Net.WebClient class. This technique is often abused by attackers to download additional payloads.
windows
Remote PowerShell Session (PS Classic)
lowDetects remote PowerShell sessions
windows
Renamed Powershell Under Powershell Channel
lowDetects a renamed Powershell execution, which is a common technique used to circumvent security controls and bypass detection logic that's dependent on process names and process paths.
windows
Use Get-NetTCPConnection
lowAdversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
windows