Windows PowerShell PSAsyncShell Asynchronous TCP Reverse Shell

Detects PowerShell use of PSAsyncShell by matching the tool name in logged script block text.

FreeUnreviewedSigmahighv1

windows-powershell-psasyncshell-asynchronous-tcp-reverse-shell-afd3df04

title: Windows PowerShell PSAsyncShell Asynchronous TCP Reverse Shell
id: 5b93f9af-80a7-421f-b9b6-f6af87f710b2
status: test
description: This rule flags PowerShell script executions containing the string "PSAsyncShell", which indicates use of an asynchronous TCP reverse shell tool written for PowerShell. Reverse shells enable an attacker to establish remote command-and-control and interactively run commands from a compromised host. The detection relies on PowerShell script block text telemetry (with script block logging enabled) to match the tool name within the executed script content.
references:
  - https://github.com/JoelGMSec/PSAsyncShell
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_psasyncshell.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-04
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: PSAsyncShell
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: afd3df04-948d-46f6-ae44-25966c44b97f
    type: derived

What it detects

This rule flags PowerShell script executions containing the string "PSAsyncShell", which indicates use of an asynchronous TCP reverse shell tool written for PowerShell. Reverse shells enable an attacker to establish remote command-and-control and interactively run commands from a compromised host. The detection relies on PowerShell script block text telemetry (with script block logging enabled) to match the tool name within the executed script content.

Known false positives

Unlikely

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.