rules/proxy/proxy_powershell_ua.yml

title: Windows PowerShell User Agent
id: c8557060-9221-4448-8794-96320e6f3e74
status: experimental
description: Detects Windows PowerShell Web Access
references:
    - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
author: Florian Roth
date: 2017/03/13
logsource:
    category: proxy
detection:
    selection:
      c-useragent: '* WindowsPowerShell/*'
    condition: selection
fields:
    - ClientIP
    - c-uri
    - c-useragent
falsepositives:
    - Administrative scripts that download files from the Internet
    - Administrative scripts that retrieve certain website contents
level: medium
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`title: Windows PowerShell User Agent`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: c8557060-9221-4448-8794-96320e6f3e74`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`status: experimental`
			`description: Detects Windows PowerShell Web Access`
Change All "str" references to be "list"to mach schema update 2018-01-28 02:24:16 +03:00			`references:`
			`- https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`author: Florian Roth`
fix: fixed missing date fields in proxy rules 2020-01-30 15:20:52 +01:00			`date: 2017/03/13`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`logsource:`
Fixed rules 2017-09-11 00:35:52 +02:00			`category: proxy`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`detection:`
			`selection:`
Fixed proxy rule field names 2019-12-07 00:11:33 +01:00			`c-useragent: '* WindowsPowerShell/*'`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`condition: selection`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`fields:`
			`- ClientIP`
Fixed proxy rule field names 2019-12-07 00:11:33 +01:00			`- c-uri`
			`- c-useragent`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`falsepositives:`
			`- Administrative scripts that download files from the Internet`
			`- Administrative scripts that retrieve certain website contents`
			`level: medium`