PowerShell Command Line Uses DInjector /am51 and /password Flags on Windows

Identifies Dinject PowerShell cradle usage by matching command-line flags '/am51' and '/password' in Windows process creation.

FreeUnreviewedSigmacriticalv1

powershell-command-line-uses-dinjector-am51-and-password-flags-on-windows-d78b5d61

title: PowerShell Command Line Uses DInjector /am51 and /password Flags on Windows
id: 8e517e12-90d4-4fed-8cb7-ef4611cf5bee
status: test
description: This rule flags Windows process creation events where the command line contains both the DInjector-specific parameters '/am51' and '/password'. These flags are characteristic of the Dinject PowerShell cradle invocation pattern used to stage and execute malicious payloads with stealth in mind. The detection relies on process command-line telemetry captured by Windows process creation logs.
references:
  - https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_dinjector.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-12-07
modified: 2023-02-04
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|all:
      - " /am51"
      - " /password"
  condition: selection
falsepositives:
  - Unlikely
level: critical
license: DRL-1.1
related:
  - id: d78b5d61-187d-44b6-bf02-93486a80de5a
    type: derived

What it detects

This rule flags Windows process creation events where the command line contains both the DInjector-specific parameters '/am51' and '/password'. These flags are characteristic of the Dinject PowerShell cradle invocation pattern used to stage and execute malicious payloads with stealth in mind. The detection relies on process command-line telemetry captured by Windows process creation logs.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.