Windows PowerShell Evidence Cleanup Script with cleanLL and while(1) Loop

Identifies PowerShell script blocks containing evidence-cleanup indicators and a repeating while(1) loop.

FreeUnreviewedSigmahighv1

windows-powershell-evidence-cleanup-script-with-cleanll-and-while-1-loop-b377ddab

title: Windows PowerShell Evidence Cleanup Script with cleanLL and while(1) Loop
id: f6794ad8-42be-457c-8e72-13465a1585d4
status: test
description: This rule flags PowerShell scripts whose ScriptBlockText contains a specific set of strings associated with attempting to remove files and delay execution in a repeating loop. Attackers may use such logic to erase or disrupt artifacts on compromised hosts, reducing chances of discovery and forensic recovery. The detection relies on Script Block Logging telemetry capturing the script text content in Windows PowerShell script executions.
references:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_eraser_script.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - cleanLL
      - usersfiles.war
      - Remove-Item -Path "$tomcat_dir
      - SysAidServer
      - "sleep "
      - while(1)
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: b377ddab-502d-4519-9e8c-5590033d2d70
    type: derived

What it detects

This rule flags PowerShell scripts whose ScriptBlockText contains a specific set of strings associated with attempting to remove files and delay execution in a repeating loop. Attackers may use such logic to erase or disrupt artifacts on compromised hosts, reducing chances of discovery and forensic recovery. The detection relies on Script Block Logging telemetry capturing the script text content in Windows PowerShell script executions.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.