rules/proxy/proxy_powershell_ua.yml

title: Windows PowerShell User Agent
id: c8557060-9221-4448-8794-96320e6f3e74
status: test
description: Detects Windows PowerShell Web Access
author: Florian Roth
references:
  - https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest
date: 2017/03/13
modified: 2021/11/27
logsource:
  category: proxy
detection:
  selection:
    c-useragent|contains: ' WindowsPowerShell/'
  condition: selection
fields:
  - ClientIP
  - c-uri
  - c-useragent
falsepositives:
  - Administrative scripts that download files from the Internet
  - Administrative scripts that retrieve certain website contents
level: medium
tags:
  - attack.defense_evasion
  - attack.command_and_control
  - attack.t1071.001
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`title: Windows PowerShell User Agent`
Added UUIDs to rules 2019-11-12 23:12:27 +01:00			`id: c8557060-9221-4448-8794-96320e6f3e74`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`status: test`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`description: Detects Windows PowerShell Web Access`
			`author: Florian Roth`
Second round 2020-09-15 07:02:30 -06:00			`references:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- https://msdn.microsoft.com/powershell/reference/5.1/microsoft.powershell.utility/Invoke-WebRequest`
			`date: 2017/03/13`
			`modified: 2021/11/27`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`logsource:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`category: proxy`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`detection:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`selection:`
			`c-useragent\|contains: ' WindowsPowerShell/'`
			`condition: selection`
Added field names to first rules 2017-09-12 23:54:04 +02:00			`fields:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- ClientIP`
			`- c-uri`
			`- c-useragent`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`falsepositives:`
$frack113$ Change status for old rules 2021-11-27 11:33:14 +01:00			`- Administrative scripts that download files from the Internet`
			`- Administrative scripts that retrieve certain website contents`
Rule: PowerShell UserAgent in Proxy Logs 2017-03-13 13:51:32 +01:00			`level: medium`
Second round 2020-09-15 07:02:30 -06:00			`tags:`
			`- attack.defense_evasion`
			`- attack.command_and_control`
Update proxy_powershell_ua.yml 2020-10-15 23:24:06 -03:00			`- attack.t1071.001`