Windows PowerShell ScriptBlock Executing POWERHOLD-like Logic via Wscript

title: Windows PowerShell ScriptBlock Executing POWERHOLD-like Logic via Wscript
id: c85512ed-0b96-4070-a853-16583d4ff585
status: test
description: This rule identifies PowerShell ScriptBlock content that references an APPDATA path and includes POWERHOLD-style execution components such as a MainPayload function and WriteAllBytes, culminating in wscript.exe execution. Attackers may use script-contained staging and file writing to prepare or launch a secondary payload through Windows Script Host. The detection relies on telemetry that captures PowerShell ScriptBlock text and evaluates it for those specific string patterns.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/FIN7/posh_ps_apt_fin7_powerhold.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.execution
  - attack.t1059.001
  - attack.g0046
  - detection.emerging-threats
logsource:
  product: windows
  category: ps_script
  definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
  selection:
    ScriptBlockText|contains|all:
      - $env:APPDATA
      - function MainPayload
      - ::WriteAllBytes
      - wscript.exe
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 71c432c4-e4da-4eab-ba49-e60ea9a81bca
    type: derived