Windows PowerShell ScriptBlock keyword match for WinPwn tool usage

Alerts when PowerShell ScriptBlock text contains WinPwn execution or script/file reference keywords.

FreeReviewedSigma · High · v2

Product: windows
Category: ps_script
Author: Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
Published: 2023-12-04
Updated: 2026-07-31

ATT&CK techniques

Execution → Discovery

Recon
Resource Dev
Initial Access
Execution
- T1106Native API
Persistence
Priv Esc
- T1548.002Bypass User Account Control
Defense Evasion
- T1548.002Bypass User Account Control
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies PowerShell ScriptBlock text containing specific strings associated with the WinPwn tool, including references to WinPwn.exe, WinPwn.ps1, and related identifiers. Such scripted tool execution and recon/exploitation behavior is high risk because it can indicate credential access, discovery, or privilege escalation attempts in Windows environments. It relies on PowerShell Script Block Logging telemetry, matching on ScriptBlockText content within executed script blocks.

Reporting behind it

Related detections9 linkedT1555.003 — drag to rearrange

Windows process command line matches WinPwn tool execution keywords

Suspicious RegAsm MSBuild or AutoIt Accessing Browser Credential Stores

Suspicious Offensive Recon and Credential Tools Execution (via process_creation)

Windows: Detect winPEAS privilege escalation reconnaissance execution

Suspicious ALPHA SPIDER Veeam Backup Credential Extraction (via process_creation)

Malicious FodHelper UAC Bypass via ms-settings Shell Command Hijack (via registry_set)

Suspicious Clipboard Data Access via Get-Clipboard (BeaverTail OtterCookie)

Suspicious UAT-10608 Hidden Credential Harvesting Script Execution via nohup

Suspicious System Profiler Hardware Enumeration (via process_creation)

Windows PowerShell ScriptBlock keyword match for WinPwn tool usage

Pivot detection · T1555.003 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-powershell-scriptblock-keyword-matches-for-winpwn-tool-execution-851fd622

title: Windows PowerShell ScriptBlock keyword match for WinPwn tool usage
id: 5b94577c-c352-4cda-8549-da3eb408a33e
related:
  - id: d557dc06-62e8-4468-a8e8-7984124908ce
    type: similar
  - id: 851fd622-b675-4d26-b803-14bc7baa517a
    type: derived
status: test
description: This rule identifies PowerShell ScriptBlock text containing specific strings associated with the WinPwn tool, including references to WinPwn.exe, WinPwn.ps1, and related identifiers. Such scripted tool execution and recon/exploitation behavior is high risk because it can indicate credential access, discovery, or privilege escalation attempts in Windows environments. It relies on PowerShell Script Block Logging telemetry, matching on ScriptBlockText content within executed script blocks.
author: Swachchhanda Shrawan Poudel, Huntrule Team
date: 2023-12-04
references:
  - https://github.com/S3cur3Th1sSh1t/WinPwn
  - https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
  - https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
  - https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
  - https://grep.app/search?q=winpwn&filter[repo][0]=redcanaryco/atomic-red-team
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_hktl_winpwn.yml
tags:
  - attack.credential-access
  - attack.discovery
  - attack.execution
  - attack.privilege-escalation
  - attack.t1046
  - attack.t1082
  - attack.t1106
  - attack.t1518
  - attack.t1548.002
  - attack.t1552.001
  - attack.t1555
  - attack.t1555.003
logsource:
  category: ps_script
  product: windows
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Offline_Winpwn
      - "WinPwn "
      - WinPwn.exe
      - WinPwn.ps1
  condition: selection
falsepositives:
  - As the script block is a blob of text. False positive may occur with scripts that contain the keyword as a reference or simply use it for detection.
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL