Windows PowerShell script parameters matching WMImplant behavior

title: Windows PowerShell script parameters matching WMImplant behavior
id: 67827441-e0e3-4ff3-8db4-cb6037dcf9cb
status: test
description: This rule flags PowerShell script block text containing specific parameters associated with WMImplant. Attackers commonly use WMImplant-like tooling to execute remote commands, manipulate user and system state, and perform host configuration changes while staying within legitimate scripting channels. The detection relies on PowerShell Script Block Logging telemetry and matches on keyword presence within the script block content.
references:
  - https://github.com/FortyNorthSecurity/WMImplant
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_wmimplant.yml
author: NVISO, Huntrule Team
date: 2020-03-26
modified: 2022-12-25
tags:
  - attack.execution
  - attack.t1047
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - WMImplant
      - " change_user "
      - " gen_cli "
      - " command_exec "
      - " disable_wdigest "
      - " disable_winrm "
      - " enable_wdigest "
      - " enable_winrm "
      - " registry_mod "
      - " remote_posh "
      - " sched_job "
      - " service_mod "
      - " process_kill "
      - " active_users "
      - " basic_info "
      - " power_off "
      - " vacant_system "
      - " logon_events "
  condition: selection
falsepositives:
  - Administrative scripts that use the same keywords.
level: high
license: DRL-1.1
related:
  - id: 8028c2c3-e25a-46e3-827f-bbb5abf181d7
    type: derived