Windows PowerShell Command Start with Powercat Invocation

title: Windows PowerShell Command Start with Powercat Invocation
id: e9ecb570-bb79-4c67-9e48-0fe4ec6ded9c
related:
  - id: bf7286e7-c0be-460b-a7e8-5b2e07ecc2f2
    type: derived
  - id: c5b20776-639a-49bf-94c7-84f912b91c15
    type: derived
status: test
description: This rule flags classic PowerShell process start activity where the command line contains the Powercat keywords 'powercat ' or 'powercat.ps1'. Attackers may use Powercat-style tooling to establish non-application-layer communication channels for command-and-control or lateral host-to-host communication. The detection relies on telemetry from PowerShell classic process start fields, specifically the command-line content captured at process creation.
references:
  - https://nmap.org/ncat/
  - https://github.com/besimorhino/powercat
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_classic/posh_pc_powercat.yml
author: frack113, Huntrule Team
date: 2021-07-21
modified: 2023-10-27
tags:
  - attack.command-and-control
  - attack.execution
  - attack.t1095
  - attack.t1059.001
logsource:
  product: windows
  category: ps_classic_start
detection:
  selection:
    Data|contains:
      - "powercat "
      - powercat.ps1
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1