Windows PowerShell Script Artifacts Containing Common Offensive String Markers

Identifies PowerShell module content containing frequent offensive payload string markers associated with poor operational security.

FreeUnreviewedSigmacriticalv1

windows-powershell-script-artifacts-containing-common-offensive-string-markers-8d31a8ce

title: Windows PowerShell Script Artifacts Containing Common Offensive String Markers
id: 8f13d6cd-f481-4c6c-8487-7094d73fabff
related:
  - id: 73e733cc-1ace-3212-a107-ff2523cc9fc3
    type: derived
  - id: 8d31a8ce-46b5-4dd6-bdc3-680931f1db86
    type: derived
status: test
description: This rule flags PowerShell module content that includes specific hard-coded string markers commonly seen in multiple offensive PowerShell payload variants. Attackers often reuse or minimally modify these artifacts, so matching these strings can surface suspicious tooling or staging behavior. The detection relies on telemetry that exposes the PowerShell module payload content and supports substring matching for the listed markers.
references:
  - https://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/
  - https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/
  - https://www.mdeditor.tw/pl/pgRt
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml
author: ok @securonix invrep_de, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-12-25
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_module
  definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
  selection_4103:
    Payload|contains:
      - $DoIt
      - harmj0y
      - mattifestation
      - _RastaMouse
      - tifkin_
      - "0xdeadbeef"
  condition: selection_4103
falsepositives:
  - Moderate-to-low; Despite the shorter length/lower entropy for some of these, because of high specificity, fp appears to be fairly limited in many environments.
level: critical
license: DRL-1.1

What it detects

This rule flags PowerShell module content that includes specific hard-coded string markers commonly seen in multiple offensive PowerShell payload variants. Attackers often reuse or minimally modify these artifacts, so matching these strings can surface suspicious tooling or staging behavior. The detection relies on telemetry that exposes the PowerShell module payload content and supports substring matching for the listed markers.

Known false positives

Moderate-to-low; Despite the shorter length/lower entropy for some of these, because of high specificity, fp appears to be fairly limited in many environments.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.