Windows PowerShell: Detect Suspicious Opsec Artifacts in Script Module Content
Identifies PowerShell module content containing frequent offensive payload string markers associated with poor operational security.
- Product
- windows
- Category
- ps_module
- Author
- ok @securonix invrep_de, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-09
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PowerShell module content that contains specific byte-pattern strings commonly seen in offensive PowerShell payload variants. Attackers sometimes leave these trivial identifiers intact across multiple payloads when making minimal changes, making them useful for behavioral triage. The detection relies on Windows PowerShell module telemetry where the script/module payload text is available and matched for the listed substrings.
Reporting behind it
- newtonpaul.comhttps://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/
- labs.sentinelone.comhttps://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/
- mdeditor.twhttps://www.mdeditor.tw/pl/pgRt
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: Detect Suspicious Opsec Artifacts in Script Module Content"
id: 8f13d6cd-f481-4c6c-8487-7094d73fabff
related:
- id: 73e733cc-1ace-3212-a107-ff2523cc9fc3
type: derived
- id: 8d31a8ce-46b5-4dd6-bdc3-680931f1db86
type: derived
status: test
description: This rule flags PowerShell module content that contains specific byte-pattern strings commonly seen in offensive PowerShell payload variants. Attackers sometimes leave these trivial identifiers intact across multiple payloads when making minimal changes, making them useful for behavioral triage. The detection relies on Windows PowerShell module telemetry where the script/module payload text is available and matched for the listed substrings.
references:
- https://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/
- https://labs.sentinelone.com/top-tier-russian-organized-cybercrime-group-unveils-fileless-stealthy-powertrick-backdoor-for-high-value-targets/
- https://www.mdeditor.tw/pl/pgRt
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml
author: ok @securonix invrep_de, oscd.community, Huntrule Team
date: 2020-10-09
modified: 2022-12-25
tags:
- attack.execution
- attack.t1059.001
logsource:
product: windows
category: ps_module
definition: 0ad03ef1-f21b-4a79-8ce8-e6900c54b65b
detection:
selection_4103:
Payload|contains:
- $DoIt
- harmj0y
- mattifestation
- _RastaMouse
- tifkin_
- "0xdeadbeef"
condition: selection_4103
falsepositives:
- Moderate-to-low; Despite the shorter length/lower entropy for some of these, because of high specificity, fp appears to be fairly limited in many environments.
level: critical
license: DRL-1.1