Merge branch 'master' into rule-devel

rules/windows/powershell/powershell_module/posh_pm_alternate_powershell_hosts.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         ContextInfo|contains: '*'

rules/windows/powershell/powershell_module/posh_pm_bad_opsec_artifacts.yml

@@ -21,7 +21,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|contains:

rules/windows/powershell/powershell_module/posh_pm_clear_powershell_history.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_1a_payload:
         Payload|contains:

rules/windows/powershell/powershell_module/posh_pm_decompress_commands.yml

@@ -17,7 +17,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|contains: 'Expand-Archive'

rules/windows/powershell/powershell_module/posh_pm_get_addbaccount.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         Payload|contains|all:

rules/windows/powershell/powershell_module/posh_pm_get_clipboard.yml

@@ -7,18 +7,18 @@ references:
     - https://threathunterplaybook.com/evals/apt29/detections/7.A.2_F4609F7E-C4DB-4327-91D4-59A58C962A02.html
 author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research)
 date: 2020/05/02
-modified: 2022/06/20
+modified: 2023/01/04
 tags:
     - attack.collection
     - attack.t1115
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
-    selection_4103:
+    selection:
         Payload|contains: 'Get-Clipboard'
-    condition: selection_4103
+    condition: selection
 falsepositives:
     - Unknown
 level: medium

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_clip.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|re: '.*cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+"'

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_obfuscated_iex.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_payload:
         - Payload|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\['

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_stdin.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|re: '.*cmd.{0,5}(?:/c|/r).+powershell.+(?:\$\{?input\}?|noexit).+"'

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_var.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|re: '.*cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*"'

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_compress.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|contains|all:

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_rundll.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|contains|all:

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_stdin.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|re: '(?i).*(set).*&&\s?set.*(environment|invoke|\$?\{?input).*&&.*"'

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_clip.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|re: '(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*'

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_mhsta.yml

@@ -9,7 +9,7 @@ references:
     - https://github.com/SigmaHQ/sigma/issues/1009 #(Task31)
 author: Nikita Nazarov, oscd.community
 date: 2020/10/08
-modified: 2022/11/29
+modified: 2023/01/04
 tags:
     - attack.defense_evasion
     - attack.t1027
@@ -18,9 +18,9 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabledd
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
-    selection_4103:
+    selection:
         Payload|contains|all:
             - 'set'
             - '&&'
@@ -28,7 +28,7 @@ detection:
             - 'vbscript:createobject'
             - '.run'
             - '(window.close)'
-    condition: selection_4103
+    condition: selection
 falsepositives:
     - Unknown
 level: high

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_use_rundll32.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|contains|all:

rules/windows/powershell/powershell_module/posh_pm_invoke_obfuscation_via_var.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         Payload|re: '(?i).*&&set.*(\{\d\}){2,}\\"\s+?-f.*&&.*cmd.*/c' # FPs with |\/r

rules/windows/powershell/powershell_module/posh_pm_powercat.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         ContextInfo|contains:

rules/windows/powershell/powershell_module/posh_pm_remote_powershell_session.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         ContextInfo|contains|all:

rules/windows/powershell/powershell_module/posh_pm_susp_ad_group_reco.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     test_2:
         - Payload|contains: get-ADPrincipalGroupMembership

rules/windows/powershell/powershell_module/posh_pm_susp_athremotefxvgpudisablementcommand.yml

@@ -7,14 +7,14 @@ references:
     - https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
 author: frack113
 date: 2021/07/13
-modified: 2022/12/02
+modified: 2023/01/04
 tags:
     - attack.defense_evasion
     - attack.t1218
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabledd
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_cmd:
         ContextInfo|contains: 'Invoke-ATHRemoteFXvGPUDisablementCommand '
@@ -24,12 +24,7 @@ detection:
             - '-ModulePath '
             - '-ScriptBlock '
             - '-RemoteFXvGPUDisablementFilePath'
-    condition: selection_cmd and selection_opt
-fields:
-    - ComputerName
-    - User
-    - CommandLine
-    - ParentCommandLine
+    condition: all of selection_*
 falsepositives:
     - Unknown
 level: medium

rules/windows/powershell/powershell_module/posh_pm_susp_get_nettcpconnection.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         ContextInfo|contains: 'Get-NetTCPConnection'

rules/windows/powershell/powershell_module/posh_pm_susp_invocation_generic.yml

@@ -3,28 +3,32 @@ id: bbb80e91-5746-4fbe-8898-122e2cafdbf4
 related:
     - id: 3d304fda-78aa-43ed-975c-d740798a49c1
       type: derived
+    - id: ed965133-513f-41d9-a441-e38076a0798f
+      type: similar
 status: experimental
 description: Detects suspicious PowerShell invocation command parameters
 author: Florian Roth (rule)
 date: 2017/03/12
-modified: 2022/12/02
+modified: 2023/01/03
 tags:
     - attack.execution
     - attack.t1059.001
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_encoded:
         ContextInfo|contains:
             - ' -enc '
             - ' -EncodedCommand '
+            - ' -ec '
     selection_hidden:
         ContextInfo|contains:
             - ' -w hidden '
             - ' -window hidden '
             - ' -windowstyle hidden '
+            - ' -w 1 '
     selection_noninteractive:
         ContextInfo|contains:
             - ' -noni '

rules/windows/powershell/powershell_module/posh_pm_susp_invocation_specific.yml

@@ -3,18 +3,22 @@ id: 8ff28fdd-e2fa-4dfa-aeda-ef3d61c62090
 related:
     - id: fce5f582-cc00-41e1-941a-c6fabf0fdb8c
       type: derived
+    - id: ae7fbf8e-f3cb-49fd-8db4-5f3bed522c71
+      type: similar
+    - id: 536e2947-3729-478c-9903-745aaffe60d2
+      type: similar
 status: experimental
 description: Detects suspicious PowerShell invocation command parameters
 author: Florian Roth (rule), Jonhnathan Ribeiro
 date: 2017/03/05
-modified: 2022/12/02
+modified: 2023/01/05
 tags:
     - attack.execution
     - attack.t1059.001
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_convert_b64:
         ContextInfo|contains|all:
@@ -64,7 +68,7 @@ detection:
         ContextInfo|contains:
             - "(New-Object System.Net.WebClient).DownloadString('https://community.chocolatey.org/install.ps1"
             - 'Write-ChocolateyWarning'
-    condition: 1 of selection* and not 1 of filter*
+    condition: 1 of selection_* and not 1 of filter_*
 falsepositives:
     - Unknown
 level: high

rules/windows/powershell/powershell_module/posh_pm_susp_local_group_reco.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     test_3:
         - Payload|contains:

rules/windows/powershell/powershell_module/posh_pm_susp_reset_computermachinepassword.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         ContextInfo|contains: 'Reset-ComputerMachinePassword'

rules/windows/powershell/powershell_module/posh_pm_susp_smb_share_reco.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         - Payload|contains: get-smbshare

rules/windows/powershell/powershell_module/posh_pm_susp_zip_compress.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection_4103:
         ContextInfo|contains|all:

rules/windows/powershell/powershell_module/posh_pm_syncappvpublishingserver_exe.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_module
-    definition: PowerShell Module Logging must be enabled
+    definition: 'Requirements: PowerShell Module Logging must be enabled'
 detection:
     selection:
         ContextInfo|contains: 'SyncAppvPublishingServer.exe'

rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml

@@ -20,7 +20,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmd:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_accessing_win_api.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_add_dnsclient_rule.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script Block Logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_adrecon_execution.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_amsi_bypass_pattern_nov22.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_amsi_null_bits_bypass.yml

@@ -0,0 +1,27 @@
+title: Potential AMSI Bypass Using NULL Bits - ScriptBlockLogging
+id: fa2559c8-1197-471d-9cdd-05a0273d4522
+related:
+    - id: 92a974db-ab84-457f-9ec0-55db83d7a825
+      type: similar
+status: experimental
+description: Detects usage of special strings/null bits in order to potentially bypass AMSI functionalities
+references:
+    - https://github.com/r00t-3xp10it/hacking-material-books/blob/43cb1e1932c16ff1f58b755bc9ab6b096046853f/obfuscation/simple_obfuscation.md#amsi-bypass-using-null-bits-satoshi
+author: Nasreddine Bencherchali
+date: 2023/01/04
+tags:
+    - attack.defense_evasion
+    - attack.t1562.001
+logsource:
+    product: windows
+    service: powershell
+    definition: 'Requirements: Script Block Logging must be enabled'
+detection:
+    selection:
+        ScriptBlockLogging|contains:
+            - "if(0){{{0}}}' -f $(0 -as [char]) +"
+            - "#<NULL>"
+    condition: selection
+falsepositives:
+    - Unknown
+level: medium

rules/windows/powershell/powershell_script/posh_ps_apt_silence_eda.yml

@@ -20,6 +20,7 @@ tags:
 logsource:
     product: windows
     service: powershell
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     empire:
         # better to randomise the order

rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         #4194304 DONT_REQ_PREAUTH

rules/windows/powershell/powershell_script/posh_ps_automated_collection.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_ext:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_capture_screenshots.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains: '.CopyFromScreen'

rules/windows/powershell/powershell_script/posh_ps_cl_invocation_lolscript.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_cl_invocation_lolscript_count.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_cl_mutexverifiers_lolscript.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_cl_mutexverifiers_lolscript_count.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_clear_powershell_history.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection1a:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_clearing_windows_console_history.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection1:
         ScriptBlockText|contains: Clear-History

rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmdlet:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_computer_discovery_get_adcomputer.yml

@@ -17,7 +17,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_copy_item_system_directory.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_copy:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_cor_profiler.yml

@@ -17,7 +17,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_create_local_user.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains: 'New-LocalUser'

rules/windows/powershell/powershell_script/posh_ps_create_volume_shadow_copy.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_data_compressed.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_detect_vm_env.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_action:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_directorysearcher.yml

@@ -12,7 +12,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script Block Logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains: System.DirectoryServices.AccountManagement

rules/windows/powershell/powershell_script/posh_ps_disable_psreadline_command_history.yml

@@ -12,7 +12,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_disable_windowsoptionalfeature.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmd:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_dnscat_execution.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains: 'Start-Dnscat2'

rules/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_kiddie:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_enable_psremoting.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmdlet:
         ScriptBlockText|contains: 'Enable-PSRemoting '

rules/windows/powershell/powershell_script/posh_ps_enable_windowsoptionalfeature.yml

@@ -19,7 +19,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmd:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_enumerate_password_windows_credential_manager.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmd:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_pwsh_remove:   #Autologger provider removal
         ScriptBlockText|contains: 'Remove-EtwTraceProvider '

rules/windows/powershell/powershell_script/posh_ps_exchange_mailbox_smpt_forwarding_rule.yml

@@ -11,7 +11,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_file_and_directory_discovery.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive.yml

@@ -12,7 +12,7 @@ date: 2022/12/23
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_get_acl_service.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_get_adcomputer.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_get_adgroup.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_get_adreplaccount.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_get_childitem_bookmarks.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_hotfix_enum.yml

@@ -11,7 +11,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_icmp_exfiltration.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_import_module_susp_dirs.yml

@@ -12,7 +12,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_import:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmdlet:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_cmdlet:
         - ScriptBlockText|contains: 'Invoke-DNSExfiltrator'

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_clip.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r).+clip(?:\.exe)?.{0,4}&&.+clipboard]::\(\s\\"\{\d\}.+-f.+"'

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_obfuscated_iex.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_iex:
         - ScriptBlockText|re: '\$PSHome\[\s*\d{1,3}\s*\]\s*\+\s*\$PSHome\['

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_stdin.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r).+powershell.+(?:\$?\{?input\}?|noexit).+"'

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_var.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|re: '.*cmd.{0,5}(?:/c|/r)(?:\s|)"set\s[a-zA-Z]{3,6}.*(?:\{\d\}){1,}\\"\s+?-f(?:.*\)){1,}.*"'

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_compress.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_rundll.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_stdin.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|re: '(?i).*(set).*&&\s?set.*(environment|invoke|\$\{?input).*&&.*"'

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_clip.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|re: '(?i).*?echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?e`?).*'

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_mhsta.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_use_rundll32.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_invoke_obfuscation_via_var.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_4104:
         ScriptBlockText|re: '(?i).*&&set.*(\{\d\}){2,}\\"\s+?-f.*&&.*cmd.*/c' # FPs with |\/r

rules/windows/powershell/powershell_script/posh_ps_keylogging.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_basic:
         ScriptBlockText|contains: 'Get-Keystrokes'

rules/windows/powershell/powershell_script/posh_ps_localuser.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_mailboxexport_share.yml

@@ -17,7 +17,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_malicious_commandlets.yml

@@ -21,9 +21,10 @@ references:
     - https://github.com/calebstewart/CVE-2021-1675 # Invoke-Nightmare
     - https://github.com/BloodHoundAD/BloodHound/blob/0927441f67161cc6dc08a53c63ceb8e333f55874/Collectors/AzureHound.ps1
     - https://bloodhound.readthedocs.io/en/latest/data-collection/azurehound.html
+    - https://github.com/HarmJ0y/DAMP
 author: Sean Metcalf, Florian Roth, Bartlomiej Czyz @bczyz1, oscd.community, Nasreddine Bencherchali, Tim Shelton, Mustafa Kaan Demir, Georg Lauenstein, Max Altgelt, Tobias Michalski, Austin Songer
 date: 2017/03/05
-modified: 2023/01/02
+modified: 2023/01/05
 tags:
     - attack.execution
     - attack.discovery
@@ -38,15 +39,18 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script Block Logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:
             - 'Add-Exfiltration'
             - 'Add-Persistence'
             - 'Add-RegBackdoor'
+            - 'Add-RemoteRegBackdoor'
             - 'Add-ScrnSaveBackdoor'
             - 'Check-VM'
+            - 'ConvertTo-Rc4ByteStream'
+            - 'Decrypt-Hash'
             - 'Do-Exfiltration'
             - 'Enabled-DuplicateToken'
             - 'Exploit-Jboss'
@@ -64,6 +68,12 @@ detection:
             - 'Get-PassHashes'
             - 'Get-RegAlwaysInstallElevated'
             - 'Get-RegAutoLogon'
+            - 'Get-RemoteBootKey'
+            - 'Get-RemoteCachedCredential'
+            - 'Get-RemoteLocalAccountHash'
+            - 'Get-RemoteLSAKey'
+            - 'Get-RemoteMachineAccountHash'
+            - 'Get-RemoteNLKMKey'
             - 'Get-RickAstley'
             - 'Get-Screenshot'
             - 'Get-SecurityPackages'
@@ -211,6 +221,7 @@ detection:
             - 'Invoke-Zerologon'
             - 'MailRaider'
             - 'New-HoneyHash'
+            - 'New-InMemoryModule'
             - 'Out-Minidump'
             - 'Port-Scan'
             - 'PowerBreach'

rules/windows/powershell/powershell_script/posh_ps_malicious_keywords.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_memorydump_getstoragediagnosticinfo.yml

@@ -12,7 +12,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_path:
         ScriptBlockText|contains: \SOFTWARE\Policies\Microsoft\Windows\System

rules/windows/powershell/powershell_script/posh_ps_msxml_com.yml

@@ -18,7 +18,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_nishang_malicious_commandlets.yml

@@ -13,7 +13,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_ntfs_ads_access.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection_content:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll.yml

@@ -14,7 +14,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains|all:

rules/windows/powershell/powershell_script/posh_ps_powerview_malicious_commandlets.yml

@@ -16,7 +16,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script Block Logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains:

rules/windows/powershell/powershell_script/posh_ps_prompt_credentials.yml

@@ -15,7 +15,7 @@ tags:
 logsource:
     product: windows
     category: ps_script
-    definition: Script block logging must be enabled
+    definition: 'Requirements: Script Block Logging must be enabled'
 detection:
     selection:
         ScriptBlockText|contains: 'PromptForCredential'