title: Malicious PowerShell Commandlet Names
id: f331aa1f-8c53-4fc3-b083-cc159bc971cb
status: test
description: Detects the creation of known powershell scripts for exploitation
author: Markus Neis
references:
  - https://raw.githubusercontent.com/Neo23x0/sigma/f35c50049fa896dff91ff545cb199319172701e8/rules/windows/powershell/powershell_malicious_commandlets.yml
date: 2018/04/07
modified: 2021/11/27
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '\Invoke-DllInjection.ps1'
      - '\Invoke-WmiCommand.ps1'
      - '\Get-GPPPassword.ps1'
      - '\Get-Keystrokes.ps1'
      - '\Get-VaultCredential.ps1'
      - '\Invoke-CredentialInjection.ps1'
      - '\Invoke-Mimikatz.ps1'
      - '\Invoke-NinjaCopy.ps1'
      - '\Invoke-TokenManipulation.ps1'
      - '\Out-Minidump.ps1'
      - '\VolumeShadowCopyTools.ps1'
      - '\Invoke-ReflectivePEInjection.ps1'
      - '\Get-TimedScreenshot.ps1'
      - '\Invoke-UserHunter.ps1'
      - '\Find-GPOLocation.ps1'
      - '\Invoke-ACLScanner.ps1'
      - '\Invoke-DowngradeAccount.ps1'
      - '\Get-ServiceUnquoted.ps1'
      - '\Get-ServiceFilePermission.ps1'
      - '\Get-ServicePermission.ps1'
      - '\Invoke-ServiceAbuse.ps1'
      - '\Install-ServiceBinary.ps1'
      - '\Get-RegAutoLogon.ps1'
      - '\Get-VulnAutoRun.ps1'
      - '\Get-VulnSchTask.ps1'
      - '\Get-UnattendedInstallFile.ps1'
      - '\Get-WebConfig.ps1'
      - '\Get-ApplicationHost.ps1'
      - '\Get-RegAlwaysInstallElevated.ps1'
      - '\Get-Unconstrained.ps1'
      - '\Add-RegBackdoor.ps1'
      - '\Add-ScrnSaveBackdoor.ps1'
      - '\Gupt-Backdoor.ps1'
      - '\Invoke-ADSBackdoor.ps1'
      - '\Enabled-DuplicateToken.ps1'
      - '\Invoke-PsUaCme.ps1'
      - '\Remove-Update.ps1'
      - '\Check-VM.ps1'
      - '\Get-LSASecret.ps1'
      - '\Get-PassHashes.ps1'
      - '\Show-TargetScreen.ps1'
      - '\Port-Scan.ps1'
      - '\Invoke-PoshRatHttp.ps1'
      - '\Invoke-PowerShellTCP.ps1'
      - '\Invoke-PowerShellWMI.ps1'
      - '\Add-Exfiltration.ps1'
      - '\Add-Persistence.ps1'
      - '\Do-Exfiltration.ps1'
      - '\Start-CaptureServer.ps1'
      - '\Invoke-ShellCode.ps1'
      - '\Get-ChromeDump.ps1'
      - '\Get-ClipboardContents.ps1'
      - '\Get-FoxDump.ps1'
      - '\Get-IndexedItem.ps1'
      - '\Get-Screenshot.ps1'
      - '\Invoke-Inveigh.ps1'
      - '\Invoke-NetRipper.ps1'
      - '\Invoke-EgressCheck.ps1'
      - '\Invoke-PostExfil.ps1'
      - '\Invoke-PSInject.ps1'
      - '\Invoke-RunAs.ps1'
      - '\MailRaider.ps1'
      - '\New-HoneyHash.ps1'
      - '\Set-MacAttribute.ps1'
      - '\Invoke-DCSync.ps1'
      - '\Invoke-PowerDump.ps1'
      - '\Exploit-Jboss.ps1'
      - '\Invoke-ThunderStruck.ps1'
      - '\Invoke-VoiceTroll.ps1'
      - '\Set-Wallpaper.ps1'
      - '\Invoke-InveighRelay.ps1'
      - '\Invoke-PsExec.ps1'
      - '\Invoke-SSHCommand.ps1'
      - '\Get-SecurityPackages.ps1'
      - '\Install-SSP.ps1'
      - '\Invoke-BackdoorLNK.ps1'
      - '\PowerBreach.ps1'
      - '\Get-SiteListPassword.ps1'
      - '\Get-System.ps1'
      - '\Invoke-BypassUAC.ps1'
      - '\Invoke-Tater.ps1'
      - '\Invoke-WScriptBypassUAC.ps1'
      - '\PowerUp.ps1'
      - '\PowerView.ps1'
      - '\Get-RickAstley.ps1'
      - '\Find-Fruit.ps1'
      - '\HTTP-Login.ps1'
      - '\Find-TrustedDocuments.ps1'
      - '\Invoke-Paranoia.ps1'
      - '\Invoke-WinEnum.ps1'
      - '\Invoke-ARPScan.ps1'
      - '\Invoke-PortScan.ps1'
      - '\Invoke-ReverseDNSLookup.ps1'
      - '\Invoke-SMBScanner.ps1'
      - '\Invoke-Mimikittenz.ps1'
  condition: selection
falsepositives:
  - Unknown
level: high
tags:
  - attack.execution
  - attack.t1059.001
