From 75c01db53ba3d63d51abdea7287cb3399321e8b0 Mon Sep 17 00:00:00 2001
From: frack113 <62423083+frack113@users.noreply.github.com>
Date: Sun, 22 Jan 2023 17:38:59 +0100
Subject: [PATCH] Add import_module dll

---
 .../posh_ps_inport_module_dll.yml             | 29 +++++++++++++++
 ...ation_win_powershell_import_module_dll.yml | 35 +++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 rules/windows/powershell/powershell_script/posh_ps_inport_module_dll.yml
 create mode 100644 rules/windows/process_creation/proc_creation_win_powershell_import_module_dll.yml

diff --git a/rules/windows/powershell/powershell_script/posh_ps_inport_module_dll.yml b/rules/windows/powershell/powershell_script/posh_ps_inport_module_dll.yml
new file mode 100644
index 000000000..a79455a6e
--- /dev/null
+++ b/rules/windows/powershell/powershell_script/posh_ps_inport_module_dll.yml
@@ -0,0 +1,29 @@
+title: Powershell Inport-Module Direct Dll - PsScript
+id: 9e620995-f2d8-4630-8430-4afd89f77604
+related:
+    - id: 70bc5215-526f-4477-963c-a47a5c9ebd12
+      type: similar
+status: experimental
+description: Detects use of Import-Module from a dll
+references:
+    - https://github.com/samratashok/ADModule
+    - https://twitter.com/cyb3rops/status/1617108657166061568?s=20
+author: frack113
+date: 2023/01/22
+tags:
+    - attack.reconnaissance
+    - attack.discovery
+    - attack.impact
+logsource:
+    product: windows
+    category: ps_script
+    definition: Script Block Logging must be enable
+detection:
+    selection:
+        ScriptBlockText|contains|all:
+            - 'Import-Module '
+            - '.dll'
+    condition: selection
+falsepositives:
+    - Legitimate use of the library for administrative activity
+level: high
diff --git a/rules/windows/process_creation/proc_creation_win_powershell_import_module_dll.yml b/rules/windows/process_creation/proc_creation_win_powershell_import_module_dll.yml
new file mode 100644
index 000000000..284d14840
--- /dev/null
+++ b/rules/windows/process_creation/proc_creation_win_powershell_import_module_dll.yml
@@ -0,0 +1,35 @@
+title: Powershell Inport-Module Direct Dll - ProccessCreation
+id: 70bc5215-526f-4477-963c-a47a5c9ebd12
+related:
+    - id: 9e620995-f2d8-4630-8430-4afd89f77604
+      type: similar
+status: experimental
+description: Detects use of Import-Module from a dll
+references:
+    - https://github.com/samratashok/ADModule
+    - https://twitter.com/cyb3rops/status/1617108657166061568?s=20
+author: frack113
+date: 2023/01/22
+tags:
+    - attack.reconnaissance
+    - attack.discovery
+    - attack.impact
+logsource:
+    product: windows
+    category: process_creation
+detection:
+    selection_img:
+        - Image|endswith:
+            - '\powershell.exe'
+            - '\pwsh.exe'
+        - OriginalFileName:
+            - 'PowerShell.Exe'
+            - 'pwsh.dll'
+    selection_cli:
+        CommandLine|contains|all:
+            - 'Import-Module '
+            - '.dll'
+    condition: all of selection_*
+falsepositives:
+    - Legitimate use of the library for administrative activity
+level: high