Windows PowerShell Script Block Keyword Matches for Suspicious Reflection and Injection Indicators

Alerts on PowerShell script block text containing reflection, dynamic assembly loading, and injection-related keywords.

FreeUnreviewedSigmamediumv1

windows-powershell-script-block-keyword-matches-for-suspicious-reflection-and-in-1f49f2ab

title: Windows PowerShell Script Block Keyword Matches for Suspicious Reflection and Injection Indicators
id: b1c55a72-8de9-496e-b3ff-bf427b3b46d5
status: test
description: This rule flags PowerShell script block contents that contain specific keyword patterns associated with assembly loading, reflection/emit behavior, unmanaged interop, and thread suspension or rundll32 usage. Such strings can indicate attempts to dynamically load code, perform in-memory execution, or leverage API-level techniques typical of exploitation tooling. It relies on Windows PowerShell script block text telemetry to match the listed substrings within the executed script content.
references:
  - https://posts.specterops.io/entering-a-covenant-net-command-and-control-e11038bcf462
  - https://github.com/PowerShellMafia/PowerSploit/blob/d943001a7defb5e0d1657085a77a0e78609be58f/CodeExecution/Invoke-ReflectivePEInjection.ps1
  - https://github.com/hlldz/Phant0m/blob/30c2935d8cf4aafda17ee2fab7cd0c4aa9a607c2/old/Invoke-Phant0m.ps1
  - https://gist.github.com/MHaggis/0dbe00ad401daa7137c81c99c268cfb7
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_keywords.yml
author: Florian Roth (Nextron Systems), Perez Diego (@darkquassar), Tuan Le (NCSGroup), Huntrule Team
date: 2019-02-11
modified: 2023-04-21
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - System.Reflection.Assembly.Load($
      - "[System.Reflection.Assembly]::Load($"
      - "[Reflection.Assembly]::Load($"
      - System.Reflection.AssemblyName
      - Reflection.Emit.AssemblyBuilderAccess
      - Reflection.Emit.CustomAttributeBuilder
      - Runtime.InteropServices.UnmanagedType
      - Runtime.InteropServices.DllImportAttribute
      - SuspendThread
      - rundll32
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 1f49f2ab-26bc-48b3-96cc-dcffbc93eadf
    type: derived

What it detects

This rule flags PowerShell script block contents that contain specific keyword patterns associated with assembly loading, reflection/emit behavior, unmanaged interop, and thread suspension or rundll32 usage. Such strings can indicate attempts to dynamically load code, perform in-memory execution, or leverage API-level techniques typical of exploitation tooling. It relies on Windows PowerShell script block text telemetry to match the listed substrings within the executed script content.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.