Add posh_ps_susp_set_alias

2023-01-08 09:55:27 +01:00
parent 0fc5066fa2
commit 2cf8529657
1 changed files with 39 additions and 0 deletions
@@ -0,0 +1,39 @@
+title: Suspicious Powershell Alias
+id: 96cd126d-f970-49c4-848a-da3a09f55c55
+status: experimental
+description: Detects Set-Alias or New-Alias that can be use to obfuscate powershell scripts
+references:
+    - https://github.com/1337Rin/Swag-PSO
+author: frack113
+date: 2023/01/08
+tags:
+    - attack.defense_evasion
+    - attack.execution
+    - attack.t1027
+    - attack.t1059.001 
+logsource:
+    product: windows
+    category: ps_script
+    definition: 'Requirements: Script Block Logging must be enabled'
+detection:
+    selection_cmdlet:
+        ScriptBlockText|contains:
+            - 'Set-Alias '
+            - 'New-Alias '
+    selection_name:
+        ScriptBlockText|contains:
+            - '-Name '
+            - '-Nam '
+            - '-Na '
+            - '-N '
+    selection_value:
+        ScriptBlockText|contains:
+            - '-Value '
+            - '-Valu '
+            - '-Val '
+            - '-Va '
+            - '-V '
+    condition: all of selection_*
+falsepositives:
+    - Unknown
+level: low