Windows PowerShell Script Block Contains "PS ATTACK!!!"

Alerts when PowerShell script blocks contain the "PS ATTACK!!!" marker on Windows.

FreeUnreviewedSigmahighv1

windows-powershell-script-block-contains-ps-attack-b7ec41a4

title: Windows PowerShell Script Block Contains "PS ATTACK!!!"
id: b59e3f53-5e70-41cc-823b-65f2e2a35fee
status: test
description: This rule flags PowerShell script block executions on Windows where the captured script text contains the marker string "PS ATTACK!!!". Attackers may use PSAttack-like tools or specific payload markers within script blocks to perform actions under PowerShell. The detection relies on PowerShell Script Block Logging telemetry that captures script content for matching against the specified string.
references:
  - https://adsecurity.org/?p=2921
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_psattack.yml
author: Sean Metcalf (source), Florian Roth (Nextron Systems), Huntrule Team
date: 2017-03-05
modified: 2022-12-25
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains: PS ATTACK!!!
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: b7ec41a4-042c-4f31-a5db-d0fcde9fa5c5
    type: derived

What it detects

This rule flags PowerShell script block executions on Windows where the captured script text contains the marker string "PS ATTACK!!!". Attackers may use PSAttack-like tools or specific payload markers within script blocks to perform actions under PowerShell. The detection relies on PowerShell Script Block Logging telemetry that captures script content for matching against the specified string.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.