huntrule

Windows PowerShell UtilityFunctions.ps1 Loading Managed DLL via Proxy

Flags PowerShell command lines referencing UtilityFunctions.ps1 with RegSnapin usage consistent with managed DLL proxy execution.

FreeUnreviewedSigmamediumv1
title: Windows PowerShell UtilityFunctions.ps1 Loading Managed DLL via Proxy
id: a86beccb-2e9f-4052-8e32-84e8f526f925
status: test
description: This rule matches PowerShell process command lines that reference UtilityFunctions.ps1 and include a RegSnapin token, indicating a Microsoft signed script being used to load or execute a managed DLL. Attackers may use this proxy behavior to execute .NET code while blending in with legitimate script naming and signing. The detection relies on process creation telemetry, specifically the command line content.
references:
  - https://lolbas-project.github.io/lolbas/Scripts/UtilityFunctions/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_lolbin_utilityfunctions.yml
author: frack113, Huntrule Team
date: 2022-05-28
tags:
  - attack.stealth
  - attack.t1216
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - UtilityFunctions.ps1
      - "RegSnapin "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 0403d67d-6227-4ea8-8145-4e72db7da120
    type: derived

What it detects

This rule matches PowerShell process command lines that reference UtilityFunctions.ps1 and include a RegSnapin token, indicating a Microsoft signed script being used to load or execute a managed DLL. Attackers may use this proxy behavior to execute .NET code while blending in with legitimate script naming and signing. The detection relies on process creation telemetry, specifically the command line content.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.