Windows PowerShell ScriptBlock detects known malicious commandlet names used by exploitation frameworks

Alerts when PowerShell ScriptBlock text includes strings matching known malicious commandlets from common exploitation toolsets.

FreeReviewedSigma · High · v2

Product: windows
Category: ps_script
Author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer (SigmaHQ), DRL 1.1
Published: 2017-03-05
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1059.001PowerShell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell ScriptBlock content that contains the names of commandlets associated with well-known PowerShell exploitation, discovery, and credential/credential-access toolsets. Attackers often embed these function names directly in in-memory scripts to enumerate, escalate, persist, and exfiltrate while avoiding dropping binaries. It relies on Windows PowerShell Script Block Logging telemetry and matches on ScriptBlockText substrings for a large allowlist of framework commandlet identifiers, excluding one EC2-specific benign pattern.

Reporting behind it

Related detections9 linkedT1069.002 — drag to rearrange

Windows PowerShell module commandlet names matching known exploitation and post-exploitation tooling

Windows Process Creation: Suspicious PowerShell Commandlets Used by Known Exploitation Tools

Windows file creation for SharpHound/BloodHound collection output filenames

Windows Process Execution of Bloodhound/SharpHound Command-Line Collection Options

Windows Process Creation: Execution of Net.exe or Net1.exe

Suspicious Group Discovery - Command (via process_creation)

Windows File Events: ADExplorer .dat Snapshot Written by ADExp.exe or ADExplorer.exe

Windows: Sysinternals ADExplorer invoked with snapshot flag to create AD database snapshot

Windows Process Creation: Sysinternals ADExplorer Snapshot Exports Active Directory Database

Windows PowerShell ScriptBlock detects known malicious commandlet names used by exploitation frameworks

Pivot detection · T1069.002 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-scriptblock-detection-of-known-malicious-commandlet-names-89819aa4

title: Windows PowerShell ScriptBlock detects known malicious commandlet names used by exploitation frameworks
id: 6a2399e2-0755-4235-a3c3-74ab8132405d
related:
  - id: 7d0d0329-0ef1-4e84-a9f5-49500f9d7c6c
    type: similar
  - id: 02030f2f-6199-49ec-b258-ea71b07e03dc
    type: similar
  - id: 6d3f1399-a81c-4409-aff3-1ecfe9330baf
    type: obsolete
  - id: 83083ac6-1816-4e76-97d7-59af9a9ae46e
    type: obsolete
  - id: 89819aa4-bbd6-46bc-88ec-c7f7fe30efa6
    type: derived
status: test
description: This rule flags PowerShell ScriptBlock content that contains the names of commandlets associated with well-known PowerShell exploitation, discovery, and credential/credential-access toolsets. Attackers often embed these function names directly in in-memory scripts to enumerate, escalate, persist, and exfiltrate while avoiding dropping binaries. It relies on Windows PowerShell Script Block Logging telemetry and matches on ScriptBlockText substrings for a large allowlist of framework commandlet identifiers, excluding one EC2-specific benign pattern.
references:
  - https://adsecurity.org/?p=2921
  - https://github.com/S3cur3Th1sSh1t/PowerSharpPack/tree/master/PowerSharpBinaries
  - https://github.com/BC-SECURITY/Invoke-ZeroLogon/blob/111d17c7fec486d9bb23387e2e828b09a26075e4/Invoke-ZeroLogon.ps1
  - https://github.com/xorrior/RandomPS-Scripts/blob/848c919bfce4e2d67b626cbcf4404341cfe3d3b6/Get-DXWebcamVideo.ps1
  - https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/6f23bb41f9675d7e2d32bacccff75e931ae00554/OfficeMemScraper.ps1
  - https://github.com/dafthack/DomainPasswordSpray/blob/b13d64a5834694aa73fd2aea9911a83027c465a7/DomainPasswordSpray.ps1
  - https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware/
  - https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/
  - https://github.com/calebstewart/CVE-2021-1675
  - https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1
  - https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html
  - https://github.com/HarmJ0y/DAMP
  - https://github.com/samratashok/nishang
  - https://github.com/DarkCoderSc/PowerRunAsSystem/
  - https://github.com/besimorhino/powercat
  - https://github.com/Kevin-Robertson/Powermad
  - https://github.com/adrecon/ADRecon
  - https://github.com/adrecon/AzureADRecon
  - https://github.com/The-Viper-One/Invoke-PowerDPAPI/
  - https://github.com/Arno0x/DNSExfiltrator/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml
author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer, Huntrule Team
date: 2017-03-05
modified: 2025-12-10
tags:
  - attack.execution
  - attack.discovery
  - attack.t1482
  - attack.t1087
  - attack.t1087.001
  - attack.t1087.002
  - attack.t1069.001
  - attack.t1069.002
  - attack.t1069
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Add-Exfiltration
      - Add-Persistence
      - Add-RegBackdoor
      - Add-RemoteRegBackdoor
      - Add-ScrnSaveBackdoor
      - ConvertTo-Rc4ByteStream
      - Decrypt-Hash
      - Disable-ADIDNSNode
      - Do-Exfiltration
      - Enable-ADIDNSNode
      - Enabled-DuplicateToken
      - Exploit-Jboss
      - Export-ADRCSV
      - Export-ADRExcel
      - Export-ADRHTML
      - Export-ADRJSON
      - Export-ADRXML
      - Find-Fruit
      - Find-GPOLocation
      - Find-TrustedDocuments
      - Get-ADIDNSNodeAttribute
      - Get-ADIDNSNodeOwner
      - Get-ADIDNSNodeTombstoned
      - Get-ADIDNSPermission
      - Get-ADIDNSZone
      - Get-ChromeDump
      - Get-ClipboardContents
      - Get-FoxDump
      - Get-GPPPassword
      - Get-IndexedItem
      - Get-KerberosAESKey
      - Get-Keystrokes
      - Get-LSASecret
      - Get-PassHashes
      - Get-RegAlwaysInstallElevated
      - Get-RegAutoLogon
      - Get-RemoteBootKey
      - Get-RemoteCachedCredential
      - Get-RemoteLocalAccountHash
      - Get-RemoteLSAKey
      - Get-RemoteMachineAccountHash
      - Get-RemoteNLKMKey
      - Get-RickAstley
      - Get-SecurityPackages
      - Get-ServiceFilePermission
      - Get-ServicePermission
      - Get-ServiceUnquoted
      - Get-SiteListPassword
      - Get-System
      - Get-TimedScreenshot
      - Get-UnattendedInstallFile
      - Get-Unconstrained
      - Get-USBKeystrokes
      - Get-VaultCredential
      - Get-VulnAutoRun
      - Get-VulnSchTask
      - Grant-ADIDNSPermission
      - Gupt-Backdoor
      - Invoke-ACLScanner
      - Invoke-ADRecon
      - Invoke-ADSBackdoor
      - Invoke-AgentSmith
      - Invoke-AllChecks
      - Invoke-ARPScan
      - Invoke-AzureHound
      - Invoke-BackdoorLNK
      - Invoke-BadPotato
      - Invoke-BetterSafetyKatz
      - Invoke-BypassUAC
      - Invoke-Carbuncle
      - Invoke-Certify
      - Invoke-ConPtyShell
      - Invoke-CredentialInjection
      - Invoke-DAFT
      - Invoke-DCSync
      - Invoke-DinvokeKatz
      - Invoke-DllInjection
      - Invoke-DNSUpdate
      - Invoke-DNSExfiltrator
      - Invoke-DomainPasswordSpray
      - Invoke-DowngradeAccount
      - Invoke-EgressCheck
      - Invoke-Eyewitness
      - Invoke-FakeLogonScreen
      - Invoke-Farmer
      - Invoke-Get-RBCD-Threaded
      - Invoke-Gopher
      - Invoke-Grouper
      - Invoke-HandleKatz
      - Invoke-ImpersonatedProcess
      - Invoke-ImpersonateSystem
      - Invoke-InteractiveSystemPowerShell
      - Invoke-Internalmonologue
      - Invoke-Inveigh
      - Invoke-InveighRelay
      - Invoke-KrbRelay
      - Invoke-LdapSignCheck
      - Invoke-Lockless
      - Invoke-MalSCCM
      - Invoke-Mimikatz
      - Invoke-Mimikittenz
      - Invoke-MITM6
      - Invoke-NanoDump
      - Invoke-NetRipper
      - Invoke-Nightmare
      - Invoke-NinjaCopy
      - Invoke-OfficeScrape
      - Invoke-OxidResolver
      - Invoke-P0wnedshell
      - Invoke-Paranoia
      - Invoke-PortScan
      - Invoke-PoshRatHttp
      - Invoke-PostExfil
      - Invoke-PowerDump
      - Invoke-PowerDPAPI
      - Invoke-PowerShellTCP
      - Invoke-PowerShellWMI
      - Invoke-PPLDump
      - Invoke-PsExec
      - Invoke-PSInject
      - Invoke-PsUaCme
      - Invoke-ReflectivePEInjection
      - Invoke-ReverseDNSLookup
      - Invoke-Rubeus
      - Invoke-RunAs
      - Invoke-SafetyKatz
      - Invoke-SauronEye
      - Invoke-SCShell
      - Invoke-Seatbelt
      - Invoke-ServiceAbuse
      - Invoke-ShadowSpray
      - Invoke-Sharp
      - Invoke-Shellcode
      - Invoke-SMBScanner
      - Invoke-Snaffler
      - Invoke-Spoolsample
      - Invoke-SpraySinglePassword
      - Invoke-SSHCommand
      - Invoke-StandIn
      - Invoke-StickyNotesExtract
      - Invoke-SystemCommand
      - Invoke-Tasksbackdoor
      - Invoke-Tater
      - Invoke-Thunderfox
      - Invoke-ThunderStruck
      - Invoke-TokenManipulation
      - Invoke-Tokenvator
      - Invoke-TotalExec
      - Invoke-UrbanBishop
      - Invoke-UserHunter
      - Invoke-VoiceTroll
      - Invoke-Whisker
      - Invoke-WinEnum
      - Invoke-winPEAS
      - Invoke-WireTap
      - Invoke-WmiCommand
      - Invoke-WMIExec
      - Invoke-WScriptBypassUAC
      - Invoke-Zerologon
      - MailRaider
      - New-ADIDNSNode
      - New-HoneyHash
      - New-InMemoryModule
      - New-SOASerialNumberArray
      - Out-Minidump
      - PowerBreach
      - "powercat "
      - PowerUp
      - PowerView
      - Remove-ADIDNSNode
      - Remove-Update
      - Rename-ADIDNSNode
      - Revoke-ADIDNSPermission
      - Set-ADIDNSNode
      - Show-TargetScreen
      - Start-CaptureServer
      - Start-Dnscat2
      - Start-WebcamRecorder
      - VolumeShadowCopyTools
  filter_optional_amazon_ec2:
    ScriptBlockText|contains:
      - Get-SystemDriveInfo
      - C:\ProgramData\Amazon\EC2-Windows\Launch\Module\
  condition: selection and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL