PowerShell ShellIntel Commandlet Abuse via Script Block Logging

Flags PowerShell script blocks that reference known ShellIntel commandlets tied to exploitation activity.

FreeUnreviewedSigmahighv1

powershell-shellintel-commandlet-abuse-via-script-block-logging-402e1e1d

title: PowerShell ShellIntel Commandlet Abuse via Script Block Logging
id: 65dcc57c-da7e-40b4-ac40-6164673d5e85
status: test
description: This rule matches PowerShell script block content containing specific ShellIntel commandlets, indicating potential automated exploitation behavior. Attackers may invoke these functions to brute-force, link payloads, or trigger privilege escalation workflows within PowerShell. It relies on Windows PowerShell script block text telemetry (with Script Block Logging enabled).
references:
  - https://github.com/Shellntel/scripts/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_shellintel_malicious_commandlets.yml
author: Max Altgelt (Nextron Systems), Tobias Michalski (Nextron Systems), Huntrule Team
date: 2021-08-09
modified: 2023-01-02
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Invoke-SMBAutoBrute
      - Invoke-GPOLinks
      - Invoke-Potato
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 402e1e1d-ad59-47b6-bf80-1ee44985b3a7
    type: derived

What it detects

This rule matches PowerShell script block content containing specific ShellIntel commandlets, indicating potential automated exploitation behavior. Attackers may invoke these functions to brute-force, link payloads, or trigger privilege escalation workflows within PowerShell. It relies on Windows PowerShell script block text telemetry (with Script Block Logging enabled).

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.