Windows PowerShell: Detect Silence/Empire EDA execution and DNS tunneling script blocks

title: "Windows PowerShell: Detect Silence/Empire EDA execution and DNS tunneling script blocks"
id: 4b3cdd2c-db7a-492c-a439-8e5e45e19f2c
status: test
description: This rule matches PowerShell ScriptBlockText containing specific Empire-style process control strings (Stop-Computer/Restart-Computer and related execution/exception indicators) alongside dnscat-style DNS tunneling parameters. The behavior matters because it indicates coordinated command execution and encrypted/encoded DNS-based communication used to maintain control and impact a target. Telemetry relies on Windows PowerShell Script Block Logging to provide the ScriptBlockText content for matching.
references:
  - https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml
author: Alina Stepchenkova, Group-IB, oscd.community, Huntrule Team
date: 2019-11-01
modified: 2023-04-03
tags:
  - attack.execution
  - attack.t1059.001
  - attack.command-and-control
  - attack.t1071.004
  - attack.t1572
  - attack.impact
  - attack.t1529
  - attack.g0091
  - attack.s0363
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  empire:
    ScriptBlockText|contains|all:
      - System.Diagnostics.Process
      - Stop-Computer
      - Restart-Computer
      - Exception in execution
      - $cmdargs
      - Close-Dnscat2Tunnel
  dnscat:
    ScriptBlockText|contains|all:
      - set type=$LookupType`nserver
      - $Command | nslookup 2>&1 | Out-String
      - New-RandomDNSField
      - "[Convert]::ToString($SYNOptions, 16)"
      - $Session.Dead = $True
      - $Session["Driver"] -eq
  condition: empire and dnscat
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 3ceb2083-a27f-449a-be33-14ec1b7cc973
    type: derived