Windows PowerShell Script Block Indicators for Nishang Commandlets and Arguments

title: Windows PowerShell Script Block Indicators for Nishang Commandlets and Arguments
id: e182610d-c7dd-4c0a-ae30-877be922dd0f
status: test
description: This rule flags PowerShell script content containing specific Nishang exploitation commandlet names and related parameters. Such commandlets are commonly used to stage backdoors, perform credential and hash dumping, encode/exfiltrate data, and execute or relay commands, making them high-signal indicators of malicious PowerShell activity. It relies on Windows PowerShell Script Block Logging telemetry by matching substrings within the captured script block text.
references:
  - https://github.com/samratashok/nishang
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml
author: Alec Costello, Huntrule Team
date: 2019-05-16
modified: 2023-01-16
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Add-ConstrainedDelegationBackdoor
      - Copy-VSS
      - Create-MultipleSessions
      - DataToEncode
      - DNS_TXT_Pwnage
      - Do-Exfiltration-Dns
      - Download_Execute
      - Download-Execute-PS
      - DownloadAndExtractFromRemoteRegistry
      - DumpCerts
      - DumpCreds
      - DumpHashes
      - Enable-DuplicateToken
      - Enable-Duplication
      - Execute-Command-MSSQL
      - Execute-DNSTXT-Code
      - Execute-OnTime
      - ExetoText
      - exfill
      - ExfilOption
      - FakeDC
      - FireBuster
      - FireListener
      - "Get-Information "
      - Get-PassHints
      - Get-Web-Credentials
      - Get-WebCredentials
      - Get-WLAN-Keys
      - HTTP-Backdoor
      - Invoke-AmsiBypass
      - Invoke-BruteForce
      - Invoke-CredentialsPhish
      - Invoke-Decode
      - Invoke-Encode
      - Invoke-Interceptor
      - Invoke-JSRatRegsvr
      - Invoke-JSRatRundll
      - Invoke-MimikatzWDigestDowngrade
      - Invoke-NetworkRelay
      - Invoke-PowerShellIcmp
      - Invoke-PowerShellUdp
      - Invoke-Prasadhak
      - Invoke-PSGcat
      - Invoke-PsGcatAgent
      - Invoke-SessionGopher
      - Invoke-SSIDExfil
      - LoggedKeys
      - Nishang
      - NotAllNameSpaces
      - Out-CHM
      - OUT-DNSTXT
      - Out-HTA
      - Out-RundllCommand
      - Out-SCF
      - Out-SCT
      - Out-Shortcut
      - Out-WebQuery
      - Out-Word
      - Parse_Keys
      - Password-List
      - Powerpreter
      - Remove-Persistence
      - Remove-PoshRat
      - Remove-Update
      - Run-EXEonRemote
      - Set-DCShadowPermissions
      - Set-RemotePSRemoting
      - Set-RemoteWMI
      - Shellcode32
      - Shellcode64
      - StringtoBase64
      - TexttoExe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: f772cee9-b7c2-4cb2-8f07-49870adc02e0
    type: derived