huntrule

Windows PowerShell ScriptBlock Execution Matching POWERTRASH Indicators

Detects PowerShell ScriptBlock text containing POWERTRASH-related in-memory and dynamic execution indicators on Windows.

FreeUnreviewedSigmahighv1
title: Windows PowerShell ScriptBlock Execution Matching POWERTRASH Indicators
id: 5e5b3183-5b43-430d-8c65-28e32b6b88b1
status: test
description: This rule flags PowerShell script content indicative of the POWERTRASH technique by matching specific ScriptBlock text elements related to in-memory execution and dynamic invocation. Attackers can use these patterns to load or execute payloads without writing clear artifacts to disk. The detection relies on Windows PowerShell script block logging that captures the referenced strings within ScriptBlockText.
references:
  - https://labs.withsecure.com/publications/fin7-target-veeam-servers
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/TA/FIN7/posh_ps_apt_fin7_powertrash_execution.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-04
tags:
  - attack.execution
  - attack.t1059.001
  - attack.g0046
  - detection.emerging-threats
logsource:
  product: windows
  category: ps_script
  definition: bade5735-5ab0-4aa7-a642-a11be0e40872
detection:
  selection:
    ScriptBlockText|contains|all:
      - IO.Compression.DeflateStream
      - IO.MemoryStream
      - ::FromBase64String
      - GetDelegateForFunctionPointer
      - .Invoke()
      - GlobalAssemblyCache
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 4e19528a-f081-40dd-be09-90c39352bd64
    type: derived

What it detects

This rule flags PowerShell script content indicative of the POWERTRASH technique by matching specific ScriptBlock text elements related to in-memory execution and dynamic invocation. Attackers can use these patterns to load or execute payloads without writing clear artifacts to disk. The detection relies on Windows PowerShell script block logging that captures the referenced strings within ScriptBlockText.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.