Log source category
ps_module log source Sigma rules
34 Sigma detection rules in the library use the ps_module log source, mostly on windows. The ps_module category groups related telemetry so you can find detections that consume the same events. Open a rule to read its detection logic, MITRE ATT&CK mapping and original YAML.
Bad Opsec Powershell Code Artifacts
criticalfocuses on trivial artifacts observed in variants of prevalent offensive ps1 payloads, including Cobalt Strike Beacon, PoshC2, Powerview, Letmein, Empire, Powersploit, and other attack payloads that often undergo minimal changes by attackers due to bad opsec.
windows
HackTool - Evil-WinRm Execution - PowerShell Module
highDetects the execution of Evil-WinRM via PowerShell Module logs by leveraging the hardcoded strings inside the utility.
windows
Invoke-Obfuscation CLIP+ Launcher - PowerShell Module
highDetects Obfuscated use of Clip.exe to execute PowerShell
windows
Invoke-Obfuscation Obfuscated IEX Invocation - PowerShell Module
highDetects all variations of obfuscated powershell IEX invocation code generated by Invoke-Obfuscation framework from the code block cited in the reference section below
windows
Invoke-Obfuscation STDIN+ Launcher - PowerShell Module
highDetects Obfuscated use of stdin to execute PowerShell
windows
Invoke-Obfuscation VAR+ Launcher - PowerShell Module
highDetects Obfuscated use of Environment Variables to execute PowerShell
windows
Invoke-Obfuscation VAR++ LAUNCHER OBFUSCATION - PowerShell Module
highDetects Obfuscated Powershell via VAR++ LAUNCHER
windows
Invoke-Obfuscation Via Stdin - PowerShell Module
highDetects Obfuscated Powershell via Stdin in Scripts
windows
Invoke-Obfuscation Via Use Clip - PowerShell Module
highDetects Obfuscated Powershell via use Clip.exe in Scripts
windows
Invoke-Obfuscation Via Use MSHTA - PowerShell Module
highDetects Obfuscated Powershell via use MSHTA in Scripts
windows
Invoke-Obfuscation Via Use Rundll32 - PowerShell Module
highDetects Obfuscated Powershell via use Rundll32 in Scripts
windows
Malicious PowerShell Commandlets - PoshModule
highDetects Commandlet names from well-known PowerShell exploitation frameworks
windows
Malicious PowerShell Scripts - PoshModule
highDetects the execution of known offensive powershell scripts used for exploitation or reconnaissance
windows
Potential RemoteFXvGPUDisablement.EXE Abuse - PowerShell Module
highDetects PowerShell module creation where the module Contents are set to "function Get-VMRemoteFXPhysicalVideoAdapter". This could be a sign of potential abuse of the "RemoteFXvGPUDisablement.exe" binary which is known to be vulnerable to module load-order hijacking.
windows
Remote PowerShell Session (PS Module)
highDetects remote PowerShell sessions
windows
Suspicious Get-ADDBAccount Usage
highDetects suspicious invocation of the Get-ADDBAccount script that reads from a ntds.dit file and may be used to get access to credentials without using any credential dumpers
windows
Suspicious PowerShell Invocations - Generic - PowerShell Module
highDetects suspicious PowerShell invocation command parameters
windows
Suspicious PowerShell Invocations - Specific - PowerShell Module
highDetects suspicious PowerShell invocation command parameters
windows
Alternate PowerShell Hosts - PowerShell Module
mediumDetects alternate PowerShell hosts potentially bypassing detections looking for powershell.exe
windows
Clear PowerShell History - PowerShell Module
mediumDetects keywords that could indicate clearing PowerShell history
windows
Invoke-Obfuscation COMPRESS OBFUSCATION - PowerShell Module
mediumDetects Obfuscated Powershell via COMPRESS OBFUSCATION
windows
Invoke-Obfuscation RUNDLL LAUNCHER - PowerShell Module
mediumDetects Obfuscated Powershell via RUNDLL LAUNCHER
windows
Potential Active Directory Enumeration Using AD Module - PsModule
mediumDetects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.
windows
PowerShell Get Clipboard
mediumA General detection for the Get-Clipboard commands in PowerShell logs. This could be an adversary capturing clipboard contents.
windows
Suspicious Computer Machine Password by PowerShell
mediumThe Reset-ComputerMachinePassword cmdlet changes the computer account password that the computers use to authenticate to the domain controllers in the domain. You can use it to reset the password of the local computer.
windows
Suspicious PowerShell Download - PoshModule
mediumDetects suspicious PowerShell download command
windows
SyncAppvPublishingServer Bypass Powershell Restriction - PS Module
mediumDetects SyncAppvPublishingServer process execution which usually utilized by adversaries to bypass PowerShell execution restrictions.
windows
Zip A Folder With PowerShell For Staging In Temp - PowerShell Module
mediumDetects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
windows
AD Groups Or Users Enumeration Using PowerShell - PoshModule
lowAdversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.
windows
Local Firewall Rules Enumeration Via NetFirewallRule Cmdlet
lowDetects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.
windows
Suspicious Get Information for SMB Share - PowerShell Module
lowAdversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
windows
Suspicious Get Local Groups Information
lowDetects the use of PowerShell modules and cmdlets to gather local group information. Adversaries may use local system permission groups to determine which groups exist and which users belong to a particular group such as the local administrators group.
windows
Use Get-NetTCPConnection - PowerShell Module
lowAdversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
windows
PowerShell Decompress Commands
informationalA General detection for specific decompress commands in PowerShell logs. This could be an adversary decompressing files.
windows