order powershell_script

rules/windows/powershell/powershell_script/powershell_invoke_nightmare.yml

@@ -0,0 +1,23 @@
+title: PrintNightmare Powershell Exploitation
+id: 6d3f1399-a81c-4409-aff3-1ecfe9330baf
+status: test
+description: Detects Commandlet name for PrintNightmare exploitation.
+date: 2021/08/09
+modified: 2021/08/31
+references:
+    - https://github.com/calebstewart/CVE-2021-1675
+author: Max Altgelt, Tobias Michalski
+logsource:
+    product: windows
+    service: powershell
+    definition: Script Block Logging must be enable
+detection:
+  selection:
+      EventID: 4104
+      ScriptBlockText|contains: Invoke-Nightmare
+  condition: selection
+falsepositives:
+    - Unknown
+level: high
+tags:
+    - attack.privilege_escalation