Windows PowerShell ScriptBlock Security Descriptor Manipulation for Potential Persistence

title: Windows PowerShell ScriptBlock Security Descriptor Manipulation for Potential Persistence
id: 63114846-8409-443e-b55a-e07e0bf4df94
status: test
description: This rule flags PowerShell ScriptBlock content that includes multiple key elements used to manipulate security descriptors, specifically calls and properties related to Trustees and ACEs and a method to set a security descriptor. The pattern also looks for strings associated with LSAs used in security descriptor payloads. Such scripting can support stealthy persistence or defense impairment by altering permissions to retain or enable unauthorized access. Detection relies on Script Block Logging telemetry capturing the full ScriptBlock text and matching the specified substrings.
references:
  - https://github.com/HarmJ0y/DAMP
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_ace_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-05
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.defense-impairment
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection:
    ScriptBlockText|contains|all:
      - win32_Trustee
      - win32_Ace
      - .AccessMask
      - .AceType
      - .SetSecurityDescriptor
    ScriptBlockText|contains:
      - \Lsa\JD
      - \Lsa\Skew1
      - \Lsa\Data
      - \Lsa\GBG
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 2f77047c-e6e9-4c11-b088-a3de399524cd
    type: derived