Windows PowerShell launcher script referencing SysAid Tomcat paths and user.exe stages

Flags PowerShell script block text tied to SysAid Tomcat webapp paths and user.exe staging/launch actions.

FreeUnreviewedSigmahighv1

windows-powershell-launcher-script-referencing-sysaid-tomcat-paths-and-user-exe--37dc5463

title: Windows PowerShell launcher script referencing SysAid Tomcat paths and user.exe stages
id: cc5c4e5e-1e9a-4bd0-ba14-b6130292d4f3
status: test
description: This rule matches PowerShell script block content that includes specific SysAidServer/Tomcat webapp paths and commands used to stage and launch user.exe, including a forced file removal pattern and indicators consistent with a loader workflow. Attackers may use PowerShell to rapidly bootstrap malware and manage payload paths, which makes this content-based detection useful for catching malicious script staging behavior. It relies on script block logging telemetry that captures the script text executed within PowerShell.
references:
  - https://www.sysaid.com/blog/service-desk/on-premise-software-security-vulnerability-notification
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/Lace-Tempest/posh_ps_apt_lace_tempest_malware_launcher.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-09
tags:
  - attack.execution
  - attack.t1059.001
  - detection.emerging-threats
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - \SysAidServer\tomcat\webapps
      - Starting user.exe
      - \usersfiles\user.exe
      - Remove-Item -Force "$wapps
      - (Sophos).
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 37dc5463-f7e3-4f61-ad76-ba59cd02a651
    type: derived

What it detects

This rule matches PowerShell script block content that includes specific SysAidServer/Tomcat webapp paths and commands used to stage and launch user.exe, including a forced file removal pattern and indicators consistent with a loader workflow. Attackers may use PowerShell to rapidly bootstrap malware and manage payload paths, which makes this content-based detection useful for catching malicious script staging behavior. It relies on script block logging telemetry that captures the script text executed within PowerShell.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.