Windows PowerShell ScriptBlock keyword matches for WinPwn tool execution

Alerts when PowerShell ScriptBlock text contains WinPwn execution or script/file reference keywords.

FreeUnreviewedSigmahighv1

windows-powershell-scriptblock-keyword-matches-for-winpwn-tool-execution-851fd622

title: Windows PowerShell ScriptBlock keyword matches for WinPwn tool execution
id: 5b94577c-c352-4cda-8549-da3eb408a33e
related:
  - id: d557dc06-62e8-4468-a8e8-7984124908ce
    type: similar
  - id: 851fd622-b675-4d26-b803-14bc7baa517a
    type: derived
status: test
description: This rule flags PowerShell ScriptBlock content containing specific WinPwn-related strings such as "Offline_Winpwn", "WinPwn ", "WinPwn.exe", or "WinPwn.ps1". Such keywords can indicate an attacker executing or staging Windows/Active Directory reconnaissance and exploitation tooling within PowerShell. It relies on Script Block Logging telemetry where ScriptBlockText is available for inspection.
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-12-04
references:
  - https://github.com/S3cur3Th1sSh1t/WinPwn
  - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
  - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
  - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
  - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml
tags:
  - attack.credential-access
  - attack.discovery
  - attack.execution
  - attack.privilege-escalation
  - attack.t1046
  - attack.t1082
  - attack.t1106
  - attack.t1518
  - attack.t1548.002
  - attack.t1552.001
  - attack.t1555
  - attack.t1555.003
logsource:
  category: ps_script
  product: windows
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Offline_Winpwn
      - "WinPwn "
      - WinPwn.exe
      - WinPwn.ps1
  condition: selection
falsepositives:
  - As the script block is a blob of text. False positive may occur with scripts that contain the keyword as a reference or simply use it for detection.
level: high
license: DRL-1.1

What it detects

This rule flags PowerShell ScriptBlock content containing specific WinPwn-related strings such as "Offline_Winpwn", "WinPwn ", "WinPwn.exe", or "WinPwn.ps1". Such keywords can indicate an attacker executing or staging Windows/Active Directory reconnaissance and exploitation tooling within PowerShell. It relies on Script Block Logging telemetry where ScriptBlockText is available for inspection.

Known false positives

As the script block is a blob of text. False positive may occur with scripts that contain the keyword as a reference or simply use it for detection.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.