PowerShell Credential Prompt Usage (Script Block Logging)

title: PowerShell Credential Prompt Usage (Script Block Logging)
id: a45b7afc-3500-4124-b5b4-4178f2ad6d72
status: test
description: This rule identifies PowerShell script content that contains the credential prompting function name "PromptForCredential". Attackers may use credential prompts to capture or relay user credentials, making this a high-signal behavior for credential access attempts. The detection relies on Windows PowerShell Script Block Logging telemetry that records script block text.
references:
  - https://twitter.com/JohnLaTwC/status/850381440629981184
  - https://t.co/ezOTGy1a1G
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml
author: John Lambert (idea), Florian Roth (Nextron Systems), Huntrule Team
date: 2017-04-09
modified: 2022-12-25
tags:
  - attack.credential-access
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: PromptForCredential
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: ca8b77a9-d499-4095-b793-5d5f330d450e
    type: derived