Windows PowerShell Script Block Abuse via System.Xml.XmlDocument Load

Flags PowerShell script blocks that use XML document loading combined with expression/command execution keywords.

FreeUnreviewedSigmamediumv1

windows-powershell-script-block-abuse-via-system-xml-xmldocument-load-6c6c6282

title: Windows PowerShell Script Block Abuse via System.Xml.XmlDocument Load
id: f4ff29b8-78de-45af-ad76-e17590be984a
status: test
description: This rule identifies PowerShell script block text that constructs a System.Xml.XmlDocument and calls Load, indicating XML-driven execution workflows. It also looks for common execution primitives such as Invoke-Expression (IEX), Invoke-Command, or shorthand ICM usage within the same script block. This matters because XML parsing and dynamic code execution are often combined to run attacker-controlled logic while staying within PowerShell. The detection relies on ScriptBlockText content from PowerShell Script Block Logging telemetry.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1059.001/T1059.001.md#atomic-test-8---powershell-xml-requests
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_xml_iex.yml
author: frack113, Huntrule Team
date: 2022-01-19
modified: 2023-01-19
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_xml:
    ScriptBlockText|contains|all:
      - New-Object
      - System.Xml.XmlDocument
      - .Load
  selection_exec:
    ScriptBlockText|contains:
      - "IEX "
      - "Invoke-Expression "
      - "Invoke-Command "
      - ICM -
  condition: all of selection_*
falsepositives:
  - Legitimate administrative script
level: medium
license: DRL-1.1
related:
  - id: 6c6c6282-7671-4fe9-a0ce-a2dcebdc342b
    type: derived

What it detects

This rule identifies PowerShell script block text that constructs a System.Xml.XmlDocument and calls Load, indicating XML-driven execution workflows. It also looks for common execution primitives such as Invoke-Expression (IEX), Invoke-Command, or shorthand ICM usage within the same script block. This matters because XML parsing and dynamic code execution are often combined to run attacker-controlled logic while staying within PowerShell. The detection relies on ScriptBlockText content from PowerShell Script Block Logging telemetry.

Known false positives

Legitimate administrative script

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.