Windows PowerShell ScriptBlock keyword match for WinPwn tool usage
Alerts when PowerShell ScriptBlock text contains WinPwn execution or script/file reference keywords.
- Product
- windows
- Category
- ps_script
- Author
- Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2023-12-04
- Updated
- 2026-07-31
ATT&CK techniques
Execution → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Defense Evasion
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies PowerShell ScriptBlock text containing specific strings associated with the WinPwn tool, including references to WinPwn.exe, WinPwn.ps1, and related identifiers. Such scripted tool execution and recon/exploitation behavior is high risk because it can indicate credential access, discovery, or privilege escalation attempts in Windows environments. It relies on PowerShell Script Block Logging telemetry, matching on ScriptBlockText content within executed script blocks.
Reporting behind it
- github.comhttps://github.com/S3cur3Th1sSh1t/WinPwn
- publicnow.comhttps://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
- reconshell.comhttps://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
- grep.apphttps://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PowerShell ScriptBlock keyword match for WinPwn tool usage
id: 5b94577c-c352-4cda-8549-da3eb408a33e
related:
- id: d557dc06-62e8-4468-a8e8-7984124908ce
type: similar
- id: 851fd622-b675-4d26-b803-14bc7baa517a
type: derived
status: test
description: This rule identifies PowerShell ScriptBlock text containing specific strings associated with the WinPwn tool, including references to WinPwn.exe, WinPwn.ps1, and related identifiers. Such scripted tool execution and recon/exploitation behavior is high risk because it can indicate credential access, discovery, or privilege escalation attempts in Windows environments. It relies on PowerShell Script Block Logging telemetry, matching on ScriptBlockText content within executed script blocks.
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-12-04
references:
- https://github.com/S3cur3Th1sSh1t/WinPwn
- https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
- https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
- https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
- https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml
tags:
- attack.credential-access
- attack.discovery
- attack.execution
- attack.privilege-escalation
- attack.t1046
- attack.t1082
- attack.t1106
- attack.t1518
- attack.t1548.002
- attack.t1552.001
- attack.t1555
- attack.t1555.003
logsource:
category: ps_script
product: windows
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains:
- Offline_Winpwn
- "WinPwn "
- WinPwn.exe
- WinPwn.ps1
condition: selection
falsepositives:
- As the script block is a blob of text. False positive may occur with scripts that contain the keyword as a reference or simply use it for detection.
level: high
license: DRL-1.1