Windows PowerShell: ScriptBlock using security descriptor (Win32_Trustee/Win32_Ace) and LSA data strings
Alerts on PowerShell ScriptBlock text that manipulates security descriptors and LSA-related identifiers, indicating possible persistence behavior.
- Product
- windows
- Category
- ps_script
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-05
- Updated
- 2026-07-31
What it detects
This rule flags PowerShell ScriptBlock content that includes multiple Win32 security descriptor elements (Win32_Trustee and Win32_Ace fields like AccessMask, AceType, and SetSecurityDescriptor) along with specific LSA-related string patterns. Attackers can use these combinations to modify security descriptor data in ways that may support stealthy persistence or defense-impairment objectives. Detection relies on Script Block logging telemetry that captures ScriptBlockText for these keywords and substrings.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows PowerShell: ScriptBlock using security descriptor (Win32_Trustee/Win32_Ace) and LSA data strings"
id: 63114846-8409-443e-b55a-e07e0bf4df94
status: test
description: This rule flags PowerShell ScriptBlock content that includes multiple Win32 security descriptor elements (Win32_Trustee and Win32_Ace fields like AccessMask, AceType, and SetSecurityDescriptor) along with specific LSA-related string patterns. Attackers can use these combinations to modify security descriptor data in ways that may support stealthy persistence or defense-impairment objectives. Detection relies on Script Block logging telemetry that captures ScriptBlockText for these keywords and substrings.
references:
- https://github.com/HarmJ0y/DAMP
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_susp_ace_tampering.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-05
tags:
- attack.persistence
- attack.privilege-escalation
- attack.defense-impairment
logsource:
product: windows
category: ps_script
definition: "Requirements: Script Block Logging must be enabled"
detection:
selection:
ScriptBlockText|contains|all:
- win32_Trustee
- win32_Ace
- .AccessMask
- .AceType
- .SetSecurityDescriptor
ScriptBlockText|contains:
- \Lsa\JD
- \Lsa\Skew1
- \Lsa\Data
- \Lsa\GBG
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 2f77047c-e6e9-4c11-b088-a3de399524cd
type: derived