Malicious PowerShell Keywords (via ps_script)

title: Malicious PowerShell Keywords (via ps_script)
id: ed53186b-573c-5dab-9fd2-a7927556c0c2
status: stable
description: This rule detects keywords from well-known PowerShell exploitation frameworks
references:
    - https://attack.mitre.org/techniques/T1059/001/
    - https://adsecurity.org/?p=2921
author: Huntrule Team
date: 2026-07-26
tags:
    - attack.execution
    - attack.t1059.001
logsource:
    product: windows
    category: ps_script
    definition: 'Requirements: Script Block Logging must be enabled'
detection:
    selection:
        ScriptBlockText|contains:
            - 'AdjustTokenPrivileges'
            - 'IMAGE_NT_OPTIONAL_HDR64_MAGIC'
            - 'Metasploit'
            - 'Microsoft.Win32.UnsafeNativeMethods'
            - 'Mimikatz'
            - 'MiniDumpWriteDump'
            - 'PAGE_EXECUTE_READ'
            - 'ReadProcessMemory.Invoke'
            - 'SE_PRIVILEGE_ENABLED'
            - 'SECURITY_DELEGATION'
            - 'TOKEN_ADJUST_PRIVILEGES'
            - 'TOKEN_ALL_ACCESS'
            - 'TOKEN_ASSIGN_PRIMARY'
            - 'TOKEN_DUPLICATE'
            - 'TOKEN_ELEVATION'
            - 'TOKEN_IMPERSONATE'
            - 'TOKEN_INFORMATION_CLASS'
            - 'TOKEN_PRIVILEGES'
            - 'TOKEN_QUERY'
    condition: selection
falsepositives:
    - Unknown
level: medium