Windows PowerShell ScriptBlock Logging: PowerView/PowerSploit Cmdlet Enumeration

title: "Windows PowerShell ScriptBlock Logging: PowerView/PowerSploit Cmdlet Enumeration"
id: d77df939-faf8-4942-b689-2018ed3aa395
related:
  - id: b2317cfa-4a47-4ead-b3ff-297438c0bc2d
    type: similar
  - id: dcd74b95-3f36-4ed9-9598-0490951643aa
    type: derived
status: test
description: This rule flags PowerShell script content containing specific cmdlet/function names associated with PowerView from the PowerSploit framework. Attackers use these cmdlets to perform discovery and reconnaissance of Active Directory objects, domain trust paths, shares, DNS, RDP/DFS artifacts, and local admin/access opportunities. The detection relies on Script Block Logging telemetry, matching cmdlet names within the recorded ScriptBlockText.
references:
  - https://powersploit.readthedocs.io/en/stable/Recon/README
  - https://github.com/PowerShellMafia/PowerSploit/tree/master/Recon
  - https://thedfirreport.com/2020/10/08/ryuks-return
  - https://adsecurity.org/?p=2277
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml
author: Bhabesh Raj, Huntrule Team
date: 2021-05-18
modified: 2023-11-22
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains:
      - Export-PowerViewCSV
      - Find-DomainLocalGroupMember
      - Find-DomainObjectPropertyOutlier
      - Find-DomainProcess
      - Find-DomainShare
      - Find-DomainUserEvent
      - Find-DomainUserLocation
      - Find-ForeignGroup
      - Find-ForeignUser
      - Find-GPOComputerAdmin
      - Find-GPOLocation
      - Find-InterestingDomain
      - Find-InterestingFile
      - Find-LocalAdminAccess
      - Find-ManagedSecurityGroups
      - Get-CachedRDPConnection
      - Get-DFSshare
      - Get-DomainDFSShare
      - Get-DomainDNSRecord
      - Get-DomainDNSZone
      - Get-DomainFileServer
      - Get-DomainGPOComputerLocalGroupMapping
      - Get-DomainGPOLocalGroup
      - Get-DomainGPOUserLocalGroupMapping
      - Get-LastLoggedOn
      - Get-LoggedOnLocal
      - Get-NetFileServer
      - Get-NetForest
      - Get-NetGPOGroup
      - Get-NetProcess
      - Get-NetRDPSession
      - Get-RegistryMountedDrive
      - Get-RegLoggedOn
      - Get-WMIRegCachedRDPConnection
      - Get-WMIRegLastLoggedOn
      - Get-WMIRegMountedDrive
      - Get-WMIRegProxy
      - Invoke-ACLScanner
      - Invoke-CheckLocalAdminAccess
      - Invoke-EnumerateLocalAdmin
      - Invoke-EventHunter
      - Invoke-FileFinder
      - Invoke-Kerberoast
      - Invoke-MapDomainTrust
      - Invoke-ProcessHunter
      - Invoke-RevertToSelf
      - Invoke-ShareFinder
      - Invoke-UserHunter
      - Invoke-UserImpersonation
      - Remove-RemoteConnection
      - Request-SPNTicket
      - Resolve-IPAddress
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1